Before a contract is concluded the policy must require the business need to be defined and a risk assessment at entity level and where applicable at group level, covering all DORA and sectoral requirements and the impact on the entity and all risks of the service, including operational, legal, ICT, reputational, confidential and personal data protection, data availability, data location, provider location and ICT concentration risks at entity level.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.