What does 12 require?

A firm has a defined and current cloud outsourcing strategy, and keeps it consistent with its other relevant strategies and with its internal policies and processes, those for ICT, information security and operational risk among them.

ESMA Guidelines on Outsourcing to Cloud Service...

Other controls in Guideline 1: Governance, oversight and documentation – ESMA Guidelines on Outsourcing to Cloud Service Providers (ESMA50-157-2403)

13 Assign responsibilities, resource compliance and set up oversight of cloud outsourcing
14 Monitor cloud service provider performance, security and service levels on a risk basis
15 Reassess whether each arrangement is critical or important
16 Maintain a register of all cloud outsourcing arrangements
17 Record the required details for every critical or important arrangement
18 Define what the register holds for non-critical arrangements

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ESMA Guidelines on Outsourcing to Cloud Service Providers (ESMA50-157-2403) controls