The third option is to rely on the supplier's own business continuity strategies and solutions, which requires assessing the supplier's continuity compliance (6.3) and writing the continuity requirements into the contract (6.4) so that the reliance is agreed and verifiable rather than assumed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.