Where appropriate, a firm may back up its own due diligence with certifications based on international standards and on external or internal audit reports about the CSP; these supplement rather than replace the firm's own assessment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.