Where a critical or important function is to be outsourced, the firm also assesses all the risks that may arise, spanning ICT, information security, continuity of the business, legal and compliance exposure, reputation and operations, together with possible limits on its own oversight, considering the selected cloud service and deployment model; the migration and implementation process; the sensitivity of the function and data and the security measures needed; interoperability between the firm's systems and those of the CSP; portability of the firm's data to another CSP or back in house; the political stability, security situation and legal system (including law enforcement, insolvency and data protection law and the conditions for personal data transfer to third countries) of the countries where the function is provided and data stored, with the extra risk of sub-outsourcers in other countries or in a chain without a direct contract; and concentration on one CSP within the firm or its group and across the EU financial sector on a handful of CSPs. Expected benefits are weighed against costs, setting risks the outsourcing reduces against risks it creates.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.