A firm clearly assigns responsibility for documenting, managing and controlling cloud outsourcing arrangements within its organisation; allocates enough resources to comply with the guidelines and with every legal requirement that applies to its arrangements; and either sets up an oversight function for cloud outsourcing or names senior staff directly accountable to the management body for managing and overseeing cloud outsourcing risks. In doing so it takes account of its nature, scale and complexity, including its risk to the financial system and the risk of the functions outsourced, and makes sure the management body has the technical skills to understand cloud outsourcing risk. Smaller and simpler firms at minimum divide the tasks and responsibilities for managing and overseeing their arrangements clearly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.