Providers must regularly review their security measures in light of relevant developments, and at least once in every 12 months review the risks of compromise to produce a written assessment of the overall risk over the next 12 months, taking account of the architecture risks, offshore monitoring tool risks, access monitoring, supplier risk, insider risk, the reviews and the results of testing under reg.14.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.