For critical or important functions a firm uses third-party certifications and audit reports only if it is satisfied that their scope takes in the CSP's main systems (its processes, applications, infrastructure and data centres), the controls the firm itself identified as key, and compliance with the law that applies; examines their content thoroughly at regular intervals and checks they are still current; sees to it that future versions keep covering those main systems and key controls; is satisfied with the certifier or auditor, including qualifications, expertise, whether evidence was re-performed or verified, and rotation; is satisfied that the certification or audit followed appropriate standards and tested whether the key controls work; holds a contractual right to ask for the scope to be widened to other relevant systems and controls, keeping such requests reasonable and justified by risk management; and keeps a contractual right to run its own on-site audits of the outsourced function when it chooses.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.