Third-party suppliers are assessed remotely, by inspection and audit, or both, with sample checks where questionnaires are relied on; ONR interventions are sampling and do not replace the dutyholder's own due diligence. Methods such as NCSC 10 Steps, Cyber Essentials, the CIS Controls, the NIST Cybersecurity Framework or ISO/IEC 27001 Annex A may be used, but an outcome-focused approach aligned to FSyP 7 is preferred, and ONR's Evidencing Expectations question sets (FSyPs 1, 2, 3, 7 and 8) align to the inherent risk levels. Assessments are recordable and repeatable, with defined scope, evidence review, physical review, interviews, control sampling, consistent reporting and follow-up, and check senior ownership, risk management, physical and personnel security and independent assurance. ONR is notified when relationships involving SNI start and end.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.