A financial institution that uses or intends to use cloud services has a cloud strategy approved by its board. The strategy sets out the IT assets in view, categorised by sensitivity and criticality, with the deployment and service models intended for them; the rationale, covering expected benefits, costs and risks; whether the cyber and technology risk framework already in place is adequate and whether internal staff have the skills and knowledge, including ongoing training, to deploy and oversee the services effectively; and what is required so that material cloud services are not unduly concentrated on a single provider or a single geographical location.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.