A processor must follow the controller's instructions and help it meet its obligations, including security and breach notification under s 13-44-202; before processing begins, a contract must set instructions, nature and purpose, data types, duration and each party's rights and obligations, require confidentiality from each person processing data, and require written subcontracts with the same obligations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.