The external web application protection requirements are implemented. Implementation includes the minimum items in 2-15-3 and must achieve the subdomain objective, so that the entity's external web applications are protected from cyber risks.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.