Due diligence on a provider of material cloud services covers at least whether the provider's risk management, internal controls, information security capability and its controls over data confidentiality, integrity and availability are adequate, taking account of vulnerability assessment, penetration test, audit and other review findings the provider makes available; whether the provider complies with this guideline, with the data protection, confidentiality and information security law that applies, and with international IT standards; its willingness and ability to honour service commitments under adverse conditions such as a cyber attack or data theft; its ability to recover outsourced systems and services within the stipulated recovery time and recovery point objectives; whether the provider's staff and subcontractors who can reach customer information are screened, security-trained, access-approved and bound to confidentiality to the extent the law permits; a forward-looking assessment of the provider's financial and operational resilience; and a proven track record of at least three years in such services. The due diligence is documented and approved.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.