Maintain an outsourcing policy covering risk assessment and materiality, risk and conflict management, approval criteria, roles, retained responsibilities, handling provider breaches and periodic review; keep a register of all group outsourcing listing provider, scope, location, dates, contacts, materiality, personal data and confidential information involved; and monitor providers' performance, finances and risks through staff with expertise, with regular review of the monitoring itself.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.