Before implementation the FI should review the proposed architecture and design, including built-in IT controls, against the defined requirements; verify that the design and implementation meet the requirements, with changes or deviations endorsed by the relevant stakeholders; and involve domain experts in the design review, for example having IT security specialists or qualified consultants review the security design and architecture.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.