To contain the risks of changes to the cloud environment the company agrees with the provider how it will be notified of changes and be able to review them; monitors major changes that could destabilise or weaken the security of the operating environment and detects erroneous or unauthorised ones; agrees the change management arrangements, covering how changes are requested, approved and notified, fallback procedures, standard changes and who is responsible for what in change management; and defines how pre-approved changes are tested.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.