A controller uses only processors that establish and comply with the Act's security measures and binds them by contract to confidentiality and security; processors act only with the controller's knowledge or authority, treat data as confidential and disclose it only when required by law or duty; complaints about processors lacking security may be made to the Office (Form 6).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.