Third-party providers' security roles and responsibilities are defined and documented as the regulator requires, with policies and procedures that govern the providers and check their compliance: agreements covering access to, processing of, communication with or management of the system or the addition of products or services cover all relevant security requirements; the providers' services, reports and records are monitored and reviewed each year or as required; changes to their provision, including maintaining and improving security policies and controls, are managed against the criticality of the systems and with risk reassessment; and their access rights are removed on termination or adjusted on change.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.