Nothing in the agreement may get in the way of the undertaking really using its access, audit and control options. Audit frequency and scope follow a risk based approach tied to criticality and risk. Where an audit technique would endanger the provider's environment or other customers, alternative ways to obtain similar assurance are agreed. Third party certifications, audit reports and pooled audits may be used to save effort, but for critical functions only if the scope covers the relevant systems and controls, the content is reviewed regularly and found current, key controls are covered in future versions, the certifier is competent, standards are suitable and include operating effectiveness testing, scope expansion can be requested reasonably, and the right to on-site audit is kept. Reliance is not solely on certificates over time, notice is given before on-site visits except in emergencies, and the staff performing or reviewing audits have the necessary cloud skills.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.