The risk assessment is documented and covers at least: the associated risks, including cyber and IT risk and concentration risk by provider and by geography, together with vulnerabilities, benefits, sustainability of the services and the effect on the institution's risk profile; how critical and sensitive the IT assets are and how material the services are; the effect of changes needed to processes and procedures; the adequacy of the internal cyber and technology risk framework, including skilled in-house resources for deployment and oversight; whether a privately managed environment over a virtual private network is needed where customer information is to go on public cloud; roles and accountabilities under the shared responsibility model; the adequacy of the control framework; the impact of risk events such as provider failure, service disruption, exit and the implications of bringing services in house or moving them to another provider; the adequacy of contingency and exit plans, including whether data and services can be moved and made to interoperate; the risk of foreign authorities gaining access to data; and the relevant legal and regulatory requirements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.