Where a critical or important function is outsourced the written agreement includes at least: a clear description of the function; start and end dates where applicable and the notice periods for both parties; governing law and any choice of jurisdiction; the financial obligations of both parties; whether sub-outsourcing is permitted and on what conditions; the regions or countries where the function will be provided and data processed and stored, the conditions attached, and a duty on the CSP to notify a proposed change of location; information security and personal data protection provisions; the firm's right to monitor the CSP's performance regularly; agreed service levels with quantitative and qualitative targets that allow timely monitoring and prompt corrective action; the CSP's reporting obligations, including reports relevant to the firm's security and key functions such as the CSP's internal audit reports; incident management provisions including the CSP's duty to report without undue delay incidents affecting the contracted service; whether the CSP must hold insurance and at what level; a requirement that the CSP maintain and exercise plans for business continuity and disaster recovery; the CSP's duty to let the firm, its competent authorities and persons they appoint have access and audit rights over the information, premises, systems and devices that matter; and provisions ensuring the firm's data can be accessed, recovered and returned as needed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.