Choose third-party libraries, middleware and hardware from suppliers practising security by design and by default so that no backdoors enter; include hardware cyber risk (such as rogue firmware) in supply chain risk assessment; ensure hardware authenticity (devices, firmware, UEFI or BIOS) and prevent tampering (tamper detection); and set secure procurement criteria requiring suppliers' legal compliance and adherence to internal security and ethics standards, maintaining supplier and sanctions lists reflecting laws, internal standards and UN sanctions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.