The administrative, management or supervisory body must see that a decision to outsource a critical or important function to the cloud rests on a thorough risk assessment covering technology, continuity, legal and compliance exposure, concentration, wider operational risk and the hazards of migrating or rolling out. Material changes in risk profile are reflected in the own risk and solvency assessment, and cloud use must fit the ICT, information security and operational risk strategies, which are updated where needed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.