Where exercising access or audit rights, or using particular audit techniques, would create a risk for the CSP's environment or for another client of the CSP, for example by degrading service levels or the confidentiality, integrity or availability of data, the CSP explains that risk clearly to the firm and the two agree another route to a comparable result, such as specific controls tested in a specific report or certification the CSP produces.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.