Management incorporates security into every phase of development and use, applying practices such as NIST SP 800-218 that reduce vulnerabilities in released software, limit the impact of exploitation and address root causes, for internally developed and acquired systems alike, monitors outsourced developers' conformance with contract requirements, the Information Security Standards and other legal and regulatory requirements, requires them to maintain secure development policies consistent with the entity's requirements and risk appetite, and applies the further secure development practices the booklet describes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.