An organization in an international supply chain that adopts this standard must both manage security across its part of the chain and have a management system that supports doing so. It shall set up and apply security practices and processes that lower the risk that activities could lead to a security incident affecting the international supply chain. An organization claiming compliance shall have a security plan, drawn from the results of the security assessment, that records the security measures and procedures already in place and adds countermeasures as needed for the part of the chain covered by its Statement of Application.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.