Staff the central third-party function with appropriately skilled people; consider critical operations' dependence on third parties, concentration risk, geopolitical risk and fourth parties (subcontractors); monitor regularly critical third parties' ability to manage their own third parties (fourth, fifth and nth parties) and their supply chain and concentration risk; prepare contingency plans and exit strategies for the withdrawal, suspension or contract termination of critical third parties and test alternatives regularly; and, for designated specified essential infrastructure operators under the Economic Security Promotion Act, take the risk management measures to be stated in notifications when introducing specified critical facilities or outsourcing their key maintenance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.