Providers must identify and reduce the risk of compromise from what third party suppliers do or omit, across the formation, life and termination of contracts and through suppliers' own subcontracting. By contract, each supplier must identify, disclose and reduce risks arising from its supply; where it is itself a network provider with access to the provider's network or sensitive data, take equivalent security measures; enable the provider to monitor all its activity; and cooperate in resolving incidents.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.