Where the provider can reach and administer the systems or software behind the assigned service, the company makes sure the provider applies its standard access management policies; duties are separated among users of systems and software, especially for sensitive and critical roles; user access is recorded in the provider's access logs and reviewed at least annually; access to the service, to public accounts and to the administrator accounts of the company's systems held with the provider is controlled through access management controls, above all for privileged accounts, with activity on those systems recorded for review; and the provider's developers have no access to the company's live environment on the cloud.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.