A financial institution establishes a comprehensive, risk-based cloud use policy approved by the board, either standing alone or built into existing policies. The policy takes in at least the requirements of this guideline, is aligned with the institution's IT and cloud strategy and its risk appetite, and is reviewed at least annually, or more often when material events are anticipated or have occurred.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.