The policy must set rules, responsibilities and processes for each lifecycle phase: management body involvement in decisions on using providers for critical or important functions; planning, including risk assessment, due diligence and approval of new or materially changed contracts; involvement of business units, internal control and other relevant units; implementation, monitoring and management, including at group level; documentation and record-keeping, including the register of information under DORA Article 28(3); and exit strategies and termination.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.