Providers manage supply chain risk across hardware, software, firmware, cloud and managed services and third-party dependencies wherever these could affect how secure, resilient or intact government and regulated sector workloads are, in line with ISO/IEC 27036 or NIST SP 800-161 or an equivalent NITDA recognises. Security operations may be run in house, drawn from shared government services or bought from accredited managed providers, provided accountability, reporting and compliance obligations stay clearly assigned.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.