Management identifies during risk identification the factors that raise the risk of supply chain attacks on purchased hardware and software and mitigates them by buying only from reputable sellers who control their own supply chains, purchasing through third parties to shield the institution's identity, reviewing hardware for anomalies, applying automated testing and code review to software, and reviewing the reliability of purchased items through activity monitoring and user-group evaluations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.