The institution designates a Qualified Individual responsible for overseeing, implementing and enforcing the information security program; the individual may be employed by the institution, an affiliate or a service provider, and where a service provider or affiliate fills the role the institution retains responsibility for compliance, designates a senior member of its own personnel to direct and oversee the Qualified Individual, and requires the provider or affiliate to maintain an information security program that protects the institution to the rule's requirements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.