Where the bank manages its ATM switch ecosystem through a third-party ASP's shared services, it ensures the ASP implements and maintains the listed controls: unauthorised software prevention (57 to 59), environmental controls (60, 61), network management (69 to 71, 73 to 77), secure configuration (66, 67), application security (79, 80, 82, 83, 84, 88), patch and change management (86, 99, 101 to 103), access control (106, 107, 112, 113), data leakage prevention (51), audit logs (94, 96), incident response (164), threat defence (144, 145) and forensics (211).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.