The institution may use independent third-party assessments, certifications and audit reports, or audits pooled with other customers of the same provider, as part of its review, audit and testing. Where it relies on reports, tests or assessments by the provider or by a third party it did not appoint, it is satisfied with the plan and scope of the work and the reports; is satisfied that those who performed it were independent, skilled and suited to the task; makes sure the IT systems and key controls are covered; and assesses the report's contents and acts on them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.