Since much cryptography arrives through suppliers, the organisation maps its cryptographic supply chain: for each supplier the products supplied, whether contracts are running and how to contact them, including certificate authorities, internal communication and collaboration tools and shadow IT; it inventories the organisations affected by its own cryptographic decisions, starts aligning PQC strategies with vendors (expecting that they will not always be explicit about PQC support) and finds new suppliers where needed.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.