Management identifies the security issues of open source software (public code, user alteration, licensing, patch tracking and publicised exploits) and mitigates them with acceptable use guidelines and a documented process for modifying and reviewing code, restrictions on unapproved shareware sites, tools to discover unapproved open source, an inventory of the type, version, location and purpose of open source in use, version and patch control, vulnerability monitoring, and evaluation of open source components inside third-party software with contract provisions to match.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.