The board holds senior management responsible for oversight of third-party relationships under an enterprise-wide program that identifies, measures, mitigates, monitors and reports third-party risk, with policies and procedures for objectives and strategy, provider selection, contract negotiation and ongoing monitoring, clear and comprehensive contracts that meet the institution's requirements, audited financial statements from providers at least annually, review of independent audits of the providers' IT controls, monitoring of provider customer service and user-group support, and procurement and oversight by staff who know the operational, financial, security and compliance requirements of the service.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.