Run a third-party agreement process that ensures security when outside parties access, process, communicate or manage the organisation's information or facilities. A small-system baseline control (Appendix K, category 4): providers agree to the system's security standards before gaining access.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.