The policy on ICT services supporting critical or important functions must reflect the entity's size, risk profile and the complexity of its services, taking into account the type of ICT services contracted; where the provider and its parent are located; whether services come from a Member State or a third country, including where they are delivered from and where data is processed and stored; the nature of data shared; whether the provider is in the same group; whether the provider is authorised, registered, supervised or overseen in the Union or a third country, or designated under the DORA oversight framework; concentration on one or few providers; transferability to another provider; and the potential impact of disruption on continuity and service availability.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.