The company identifies and manages the risks of using cloud services and builds them into its overall risk assessment framework, documented and kept up to date, covering at least the provider's role in the business strategy; comprehensive procedures for the connection requirements with the provider so that key risks are identified and mitigated; the provider's ability to apply high standards and deliver efficiently; the effect of cloud use on the company's overall risk profile; the applicable laws and law enforcement provisions, how secure and politically stable the provider's country is, and its data protection law; the financial, operational, legal and reputational risks if the provider fails to perform; and the overall security risks of the assigned service, with the roles of company and provider in managing them, the mitigation steps and a documented evaluation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.