The organisation assesses the performance of external providers at planned intervals and adjusts the type and extent of control to manage the associated risks and opportunities. It maintains documented information defining how the 8.4.2 requirements are met, determines in accordance with 8.1 the risks to achieving specified requirements and to realising improvement opportunities for externally provided products and services, and retains documented information demonstrating the effectiveness of the verification or other activities needed to make sure what is provided externally meets requirements; Annex C gives guidance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.