When the entity engages suppliers of goods or services it must write security requirements into the contract: protection of the information and assets the supplier can reach; proof that the supplier applies adequate security measures, with clauses allowing documentary or audit verification; supply chain transparency so the supplier can show the origin and security of what it delivers; consequences for failing the security requirements; liability for missing agreed deadlines, quantities or quality where that threatens security objectives; and cooperation during incidents, naming at least contact points, reporting procedures, response and recovery times and incident closure conditions. The entity names the employee or employees who watch supplier compliance and service levels, and prepares an action plan for the case where a supplier does not deliver what was agreed.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.