The institution performs due diligence on the provider and its RFP response to verify that it meets the institution's needs, confirming corporate existence and history, the qualifications, backgrounds and reputations of principals with criminal checks where appropriate, references from other clients, financial status through audited statements, strategy and reputation, service delivery capability, technology and architecture, internal controls, security history and audit coverage, legal and regulatory compliance including complaints and litigation, reliance on third parties, insurance and disaster recovery and continuity capability, together with service philosophy, quality initiatives and cultural fit, at a depth set by the risk of the relationship and applying the foreign-provider considerations where relevant.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.