Assess the risk of each outsourcing before starting, on variation or renewal and at least annually, including whether it is material, weighing impact of failure, effect on compliance and internal controls, complexity, cost, the provider's regulatory status and location, and difficulty of replacement; perform detailed due diligence on the provider's capability, resources, finances, reputation, regulatory status, subcontracting, culture and industry familiarity, and review the provider at least annually.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.