The institution uses qualified information security personnel, employed by it, an affiliate or a service provider, sufficient to manage its information security risks and to perform or oversee the program.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.