The institution reviews every material cloud service and every cloud service involving customer information. The review at least assesses risks and controls end to end, including oversight of the services; verifies that each provider is still honouring its contractual, legal and regulatory obligations; and verifies that the services comply with the guideline and with the institution's board-approved cloud use policy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.