The organisation identifies and documents its upstream and downstream supply chain, in particular the subcontractors it uses to perform security operations, decides and records how far down the chain its security operations management programme reaches, and includes the management of supply chain risk in that programme wherever significant risk has been identified and the potential for harm exists.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.