What does 20 require?

The analysis and due diligence done before outsourcing are scaled to how large, complex and risky the function is, and at minimum assess how the arrangement could affect the firm across operational, legal, compliance and reputational risk.

ESMA Guidelines on Outsourcing to Cloud Service...

Other controls in Guideline 2: Pre-outsourcing analysis and due diligence – ESMA Guidelines on Outsourcing to Cloud Service Providers (ESMA50-157-2403)

19 Before outsourcing: assess criticality, risks, due diligence and conflicts of interest
21 For critical or important functions: assess the full risk picture and weigh costs and benefits
22 Evaluate the suitability of the cloud service provider for critical or important functions
23 Use certifications and audit reports to support due diligence where appropriate
24 Review or redo due diligence when significant deficiencies or changes come to light
25 Decide on a risk basis whether new due diligence is needed for a new or renewed arrangement with an assessed CSP

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ESMA Guidelines on Outsourcing to Cloud Service Providers (ESMA50-157-2403) controls