The outsourcing policy and related policies such as information security are updated for cloud specifics: roles of the AMSB and of the ICT, security, compliance, risk and internal audit functions; approval, implementation, monitoring and renewal processes; proportionate oversight including provider due diligence, risk assessment frequency, service level checks and security controls; reference to the contractual requirements of Guideline 10; documentation and notification to the supervisor; and a documented, suitably tested exit strategy for each critical or important arrangement, which may mean ending, bringing back in or moving the service.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.