Where the function is critical or important, and leaving GDPR duties untouched, a firm, working on a risk basis, at minimum: divides information security roles between itself and the CSP clearly (threat detection, incident handling and patching included) and satisfies itself the CSP can carry its share; puts strong authentication such as multi-factor and access controls in front of its data and back-end cloud resources; applies encryption where needed to data in transit, in memory, at rest and in backups, with key management that keeps the keys from unauthorised hands, choosing a key management solution with current technology and processes in mind; considers network availability, segregation (tenant isolation; separating the web, application, operating system, network, database and storage layers) and separate test, acceptance, development and production environments; considers how to secure the APIs that join the cloud service to its own systems; puts effective continuity and disaster recovery controls in place, for example minimum capacity, geographically spread hosting that can switch over, documented routes the data travels and the ability to copy machine images to an isolated or offline store; decides on a risk basis which regions or countries may store and process its data; and confirms that the CSP meets internationally recognised information security standards and runs suitable controls, for example by obtaining evidence of the CSP's own security reviews and by running its own regular assessments and tests.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.