Outsourcing of work (personal information handling, security, system operation or development) and use of external facilities or services (data centres, cloud, application services) within scope is identified, and legal requirements and risks from them assessed with suitable protection measures.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.