The manufacturer demonstrates how its CSMS manages dependencies on contracted suppliers, service providers or its own sub-organizations with regard to the processes of 7.2.2.2. The Interpretation Document: risks from what is supplied must be knowable and manageable, proportionately; processes identify supplier risks, manage risks from connectivity and service providers (cloud, telecom, internet, authorised aftermarket), require suppliers to evidence their risk management and delegate requirements internally; cascading beyond Tier 2 is recognized as hard; unfulfilled where supplier contracts carry no cyber security requirements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.