Where its Risk Assessment shows this to be appropriate, the Licensee follows secure development practices for applications it builds in-house and uses, and has procedures for evaluating, assessing or testing how secure the externally built applications it uses are.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.