Control mechanisms meet government security requirements: the B/D applies due diligence and oversight to the external provider for its business, security and privacy needs and adds its own controls where the provider does not fully cover a risk. The provider secures the hosts and applications it supplies against external threats and unauthorised access through practices such as OS hardening, current patching and anti-malware, intrusion detection and prevention and firewalls at hypervisor, network or host level, conducts security risk assessments regularly, and the B/D reviews the provider's security risk assessment and audit report regularly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.