The policy must set a proportionate selection and assessment process, noting whether the provider is intra-group, and require the entity to assess before contracting whether the provider has the reputation, abilities, expertise, financial, human and technical resources, security standards, organisation, risk management, internal controls and any required authorisation; can track technology and adopt security leading practice; uses or plans to use subcontractors for the service or material parts; is located or processes or stores data in a third country and how that affects operational, reputational or sanctions risk; agrees to effective audits including on-site by the entity, appointed third parties and authorities; and acts ethically and responsibly, respecting human and children's rights, environmental principles and working conditions. The policy must set the required level of assurance on the provider's risk management, including its continuity measures, and state which assurance sources are used: own or commissioned audits, independent audit reports, the provider's internal audit reports, certifications or other information, using more than one where appropriate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.