Due diligence for critical or important functions includes an evaluation of the CSP's suitability: the firm makes sure the CSP has the business reputation, skills, resources (human, IT and financial), organisational structure and, where applicable, the authorisations or registrations to perform the function reliably and professionally and to meet its obligations for the life of the arrangement. Further factors include how the CSP manages information security, above all how it protects personal, confidential and other sensitive data, its service support including support plans, contacts and incident management processes, and its business continuity and disaster recovery plans.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.