The institution maintains ongoing business continuity and information security monitoring programs over its technology service providers, takes responsibility for the parts of its continuity program performed by providers, identifies the continuity and security responsibilities of all parties, identifies which critical services rely on providers including telecommunications and network providers, understands the providers' continuity requirements, incorporates them into its own plan, requires annual testing of the provider's plan with results reported and notification of plan changes, integrates the provider's plan into its own, communicates functions to personnel, reviews the combined plan periodically, and provides for termination of services under the contract terms.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.