Describe how vendor and partner risk is handled: identifying and inventorying relevant vendors and partners; considering threats arising where outside parties hold, handle or send sensitive information for the entity, including their own suppliers (fourth parties); evaluating risks that insurance could mitigate; and managing them through engagement requirements (scope, responsibilities, compliance, service levels), periodic risk assessment, assigned accountability, communication and issue resolution protocols including threat reporting, exception handling, periodic performance assessment and risk treatment procedures.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.