The institution carries out due diligence on a provider before taking up its services. The extent of that due diligence, including whether onsite or remote audits are required, matches the materiality of the services and IT assets involved and the degree to which the institution relies on the provider to maintain effective security controls.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.