Where the organization relies on business partners within the supply chain set out in its Statement of Application, it shall, with the exceptions allowed by 4.3 and 4.4, ask each of them for a security declaration and take that declaration into account in its security assessment; it may also require particular countermeasures to be put in place.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.