Management runs supply chain risk management that identifies susceptibilities, vulnerabilities and threats from the supplier, the product and its subcomponents and the supply chain from production through transport, operation and disposal, adds identification, measurement, monitoring and control of supply chain risk to acquisition and procurement, monitors, controls and protects communications about supply chain activities at external and key internal boundaries, uses architectural design, development technique and systems engineering to secure the supply chain, complies with OFAC sanctions, and applies the practices of NIST SP 800-161 the booklet sets out at length.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.