The institution meets its legal responsibility under GLBA 501(b) by requiring providers, through measures derived from its own security process and included or referenced in the contract, to take appropriate security measures, exercises due diligence to protect institution and customer assets, ensures before contracting and throughout the relationship that the provider's physical and data security standards meet or exceed its own, and gives providers and vendors access only to the information and systems they need, with access controls and monitoring between the provider's systems and its own.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.