Senior management supervises how cloud services are designed, built and brought into use, and makes sure that the cloud use policy is documented and board-approved; a thorough risk assessment precedes any use; the design of the arrangement, the security architecture in the cloud, the mitigating measures and other controls are robust and adequate for the identified risks from day one and over time, with cloud security controls at least as stringent as on premise; the security arrangements on premise and in the cloud and the business continuity plans are evaluated independently before implementation and on an ongoing basis; where customer information is to be hosted on public cloud, the risk management framework reflects the characteristics unique to public cloud and the chosen service model; responsibilities and accountabilities between the institution and the provider are clearly delineated and managed, with the institution's own responsibilities understood and the provider's overseen (the Annex Schedule II shared responsibility matrix is offered as guidance); the board is kept informed of implementation status, ongoing performance and current or emerging risks; and performance is monitored continuously with incidents identified, escalated and reported in time.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.