Supplier selection for services handling important or personal information considers security and privacy capability; security and privacy requirements of outsourcing or external services are identified and written into contracts or agreements, including requirements for outsourced system development.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.