Exercise due diligence in selecting Third-Party Service Providers and require Third-Party Service Providers to implement appropriate administrative, technical, and physical measures to protect and secure the Information Systems and Nonpublic Information that are accessible to or held by Third-Party Service Providers. Conduct periodic assessment of Third-Party Service Providers based on the risk they present and the continued adequacy of their cybersecurity practices. Maintain contractual obligations including SOC 2 Type II reports + audit rights + notification on cybersecurity events + termination rights + return of data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.