SIG risk domain T, Threat Management. The third party manages threats with automated and manual tools and runs vulnerability management through structured assessments that identify, quantify and prioritise weaknesses, using manual inspection, threat modelling, penetration testing, code review, input validation and vulnerability scanning, and relates findings to the potential impact on the outsourcer's environment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.