The control team must keep the documentation from testers and threat intelligence providers that evidences compliance with Article 7(1)(a) to (f). In exceptional circumstances the entity may contract providers that do not meet one or more of those requirements if it adopts and records appropriate measures to mitigate the resulting risks.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.