During the contract term the supplier communicates changes in its chain of subcontractors with the associated risks, covering at minimum any vulnerability or information security incident that can affect what the entity receives.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.