Cybersecurity requirements for third parties are periodically reviewed. The review confirms the requirements remain applied and effective against the subdomain objective, so that the entity's assets are protected from third-party risks, including IT outsourcing, cybersecurity outsourcing and managed services; NCA's guide suggests a documented review plan with a set interval, a compliance assessment report and approval of changes by the head of the entity or delegate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.