What does 18 require?

For arrangements that are neither critical nor important, the firm itself decides what the register records, scaled to how large, complex and risky the outsourced function is.

ESMA Guidelines on Outsourcing to Cloud Service...

Other controls in Guideline 1: Governance, oversight and documentation – ESMA Guidelines on Outsourcing to Cloud Service Providers (ESMA50-157-2403)

12 Keep a defined, up-to-date cloud outsourcing strategy
13 Assign responsibilities, resource compliance and set up oversight of cloud outsourcing
14 Monitor cloud service provider performance, security and service levels on a risk basis
15 Reassess whether each arrangement is critical or important
16 Maintain a register of all cloud outsourcing arrangements
17 Record the required details for every critical or important arrangement

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ESMA Guidelines on Outsourcing to Cloud Service Providers (ESMA50-157-2403) controls