Management uses threat modelling to determine the risks of internal, external or hybrid software hosting and implements controls accordingly: for internally hosted software it identifies personnel with the skills to manage the hosting environment and funds their training and applies a security-incorporating development life cycle; for externally hosted services such as core processing, web hosting, off-site backup and virtual desktops it secures contract provisions on notification of infrastructure changes and the use of subcontractors; and for hybrid arrangements it manages the responsibilities of both.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.