A documented process, put into practice, must review how suppliers perform on an ongoing basis, using risk and defined criteria. Supplier questionnaires are reissued at least every 3 years, suppliers must report significant changes in between (including changes to certification status), and records of the review are kept.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.