Require the developer to follow a documented development process that explicitly addresses security and privacy requirements, identifies the standards and tools used, documents tool options and configurations, and documents, manages and ensures the integrity of changes to the process and tools; and review the process, standards, tools and configurations to confirm they can satisfy the security and privacy requirements through design, development, implementation, operation and disposal.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.