The provider identifies subservice organisations and supply chain dependencies relevant to the assessed service, and reflects their treatment (inclusive or carve-out) in the assurance statement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.