A licensee using cloud computing services has a cloud strategy and policy, risk-based, that addresses the IT assets concerned, the cloud service being acquired and the deployment model chosen, deciding for instance whether a privately managed cloud on a private network is the right home for customer information; the rationale, with expected benefits, costs and risks; its framework for managing cloud risk, with cybersecurity and data protection handled as the law and regulations require; and the skills, expertise and continuing training internal staff need to run the deployment and keep watch over it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.