There must be a documented and implemented process for ongoing performance review of service suppliers based on risk and defined criteria, with records kept.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.