A licensee establishes and keeps at all times a robust, documented risk management framework that identifies, assesses, manages, mitigates and reports the risks of adopting cloud services. The framework takes into account the vulnerabilities and benefits, including whether the services are adequate and sustainable and what their implementation or any change to them entails; the cybersecurity, IT and concentration risks tied to the provider and its locations, addressed through measures such as encrypting data, controlling access, securing the network and responding to incidents; how critical the IT assets are and how sensitive the personal data is; whether internal staff are skilled and expert enough; the roles and responsibilities of licensee and provider under the outsourcing arrangement; the impact of risk events such as service disruption, provider failure, exit and the implications of moving services in house or to another provider; whether the contingency plan and exit strategy are adequate, including whether data and services are portable and interoperable; and the relevant legal and regulatory frameworks. The framework is aligned with the materiality assessment framework.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.