The entity must not rely over time solely on certifications or provider audit reports. The policy may allow their use only where the entity is satisfied with the provider's audit plan; makes sure their scope covers the systems and key controls it identified and regulatory requirements; assesses their content on an ongoing basis and checks they are not out of date; makes sure key systems and controls are covered in future versions; is satisfied with the competence of the certifying or auditing party; is satisfied they are issued to recognised professional standards and test operating effectiveness of key controls; has the contractual right to ask for reasonable scope changes; and has the contractual right to perform individual and pooled audits at its discretion at the agreed frequency.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.