The organization shall, for all business partners except those falling under 4.3 or 4.4, examine the partners' processes and facilities to confirm that their security declarations hold good. How far and how often it does so shall be decided by analysing the risks, and the organization shall keep the findings.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.