Both standards (8.1) require outsourced processes to be determined and controlled, ISO/IEC 27001 Annex A has supplier controls, and ISO/IEC 20000-1 treats other parties (external and internal suppliers, customers acting as supplier) that can contribute a major part of a service, with requirements for information security management (8.7.3) including risk from external organisations, supplier management (8.3.4) and control of parties in the service life cycle (8.2.3). Two considerations shape supplier practice in the integrated system: contractual information security obligations should feed the risk assessment process, which in turn should help meet the ISO/IEC 20000-1 requirement to consider other-party risk; and information security should be considered wherever other parties design, build, test, deploy or operate a new or changed service, and in the agreements with them. Business relationship management concepts (performance reviews, service changes, satisfaction, complaints) can strengthen the whole system. Where another party controls assets inside the ISMS scope, suitable contracts or other documented agreements should be put in place that ensure the party applies appropriate controls, and the SMS risk assessments can be extended with ISO/IEC 27001 requirements to ask whether adding or removing a supplier, or altering a service it contributes to, compromises security.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.