The board keeps ultimate responsibility for cloud services being run safely and soundly and in compliance with law and regulation, and for the associated risks being identified, understood, monitored and mitigated. It approves the cloud strategy, the cloud use policy and the criteria for assessing materiality; approves and oversees material cloud services and makes sure each has an appropriate business continuity and contingency or exit plan; sets the approval authorities for non-material services; learns of every cloud service when it starts and stays informed afterwards, and is promptly told of any critical issue or incident; makes sure the policy is aligned with IT strategy, cloud strategy, architecture, risk appetite and regulatory requirements; makes sure the service and deployment models fit how material the IT assets are and what security arrangements exist; makes sure there is a risk assessment framework with adequate coverage by the control functions and external auditors; makes sure the board, senior management and relevant staff have the expertise, experience and training to oversee cloud services; and receives, with the audit committee, periodic reports on the audits, testing and reviews required by section 8 and is satisfied with the remediation plans.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.