The policy must assign internal responsibility for approving, managing, controlling and documenting the contracts and keep enough skills, experience and knowledge in house to oversee them and the services delivered. Without reducing the entity's own final responsibility, it must require an assessment that the provider has sufficient resources for the entity to meet its legal and regulatory duties for the services. It must name the role or senior manager responsible for monitoring the contracts, how that person works with the control functions, the reporting lines to the management body, what is reported and how often.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.