Senior executive management, each according to their post, builds an effective governance and operating structure for managing the risks of cloud services; sees that the cloud computing policy is developed, supervised, reviewed and updated periodically and whenever needed; approves the agreements with the cloud provider; makes sure due diligence on the provider is performed before any agreement; reviews the risk assessment results for every cloud agreement against a board-approved risk assessment framework; reviews the periodic reports on provider performance; sees that disaster recovery plans built on malfunction, penetration and destructive-action scenarios exist and are tested periodically; makes sure the provider is continuously monitored against the service level agreement; and makes sure every activity assigned to the provider is reviewed by the relevant parties in the company, with the board told regularly of the risks it may incur.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.