The company sets key risk indicators that keep cloud risk within its risk appetite and tolerance; identifies current best practice in cloud use, including information security, cyber risk and regulatory requirements; monitors risks and defines what to do if the provider fails to deliver at the agreed level; identifies the impact on customers if the provider fails or breaches the confidentiality of their data; manages the security risks of storing data and running applications on the provider's systems; and monitors the concentration risk of relying on a single provider for all assigned services, with the procedures to follow if that provider fails.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.