Every Licensee creates, puts in place and keeps up a comprehensive Information Security Program in writing, grounded in its Risk Assessment and made up of administrative, technical and physical safeguards that protect Nonpublic Information and the Information System. The program is sized to the Licensee's scale and complexity, to the nature and reach of what it does (its reliance on Third-Party Service Providers included), and to how sensitive the Nonpublic Information it uses or holds is.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.