Management decides whether software is developed internally, by its own or an engaged team with the resources and expertise to track vulnerabilities and produce updates and patches, or obtained externally as commercial off-the-shelf software whose default functionality may not meet the entity's needs or security requirements without configuration and integration work, or as custom software developed by the entity or a third party through modules and extensions, and manages the maintenance and support responsibilities each option carries.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.