A firm writes its information security requirements into its own policies and procedures and into the cloud outsourcing agreement, then keeps checking that they are met, not least to protect confidential, personal and other sensitive data; the requirements are scaled to how large, complex and risky the outsourced function is.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.