Include in acquisition contracts, explicitly or by reference and in agency-defined contract language, the security and privacy functional, strength-of-mechanism, assurance, control, documentation and documentation-protection requirements, a description of the development and operating environments, the allocation of responsibility for security, privacy and supply chain risk management, and acceptance criteria.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.