Dutyholders manage risk to SNI held in their supply chain, using a risk-based method to set proportionate assurance for physical protection at third-party premises and approving contractors' physical and other security measures against the Government Functional Standard GovS 007 as qualified by the FSyPs. Supply chain facilities holding SNI are recorded and approved on List N, and in-contract monitoring keeps controls commensurate for as long as SNI is held.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.