When a customer entrusts data or systems to a third party, the level of risk the customer accepts and the level the third party accepts can differ; neither standard covers this explicitly, so the organisation should be aware of it and decide clearly which levels of risk each party controls. The issues are the customer's view of acceptable security for its information held by the third party against what the third party thinks sufficient; information the organisation holds about the third party, such as its financial records, for which the third party has its own view; and the different legal and regulatory environments the parties may sit in, by country or sector. Security expectations and responsibilities should be discussed at the earliest opportunity, both while the scope of an implementation project is being agreed and when putting operational controls on existing services, with conflicts identified and decisions agreed, ideally before implementation. Both standards require risk acceptance criteria, which can differ between the two perspectives.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.