An outsourced cloud service register contains the following for each outsourced cloud service: - cloud service provider's name - cloud service's name - purpose for using the cloud service - sensitivity or classification of data involved - due date for the next security assessment of the cloud service - contractual arrangements for the cloud service - point of contact for users of the cloud service - 24/7 contact details for the cloud service provider.
This control maps to 4 controls across 3 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 4 it maps to, and the evidence behind each claim, over MCP and REST.