For IT and cyber third-party arrangements outside the Outsourcing Directions (paragraphs 126 to 135), the bank runs a vendor risk assessment with controls proportionate to risk and materiality to mitigate concentration risk, eliminate or manage conflicts of interest, mitigate single points of failure, comply with requirements to protect customer data, provide high availability and manage supply chain risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.