Permit authorized individuals to use an external system to reach the agency system or to handle organization-controlled information only after the controls on the external system have been verified against the agency's security and privacy policies and plans, or approved connection or processing agreements with the hosting entity are retained.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.