Without prejudice to its final responsibility for its cloud outsourcing arrangements, and so that audit effort is spent efficiently and the CSP and its other clients are not overburdened, a firm may rely on certifications from third parties and on external or internal audit reports the CSP makes available, and on pooled audits run jointly with the CSP's other clients or by an auditor several clients appoint.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.