Whenever a function is outsourced to a cloud provider the licensee performs appropriate due diligence, before entering the arrangement and accepting the services, to confirm that the provider is fit and proper, is able to deliver the function and can comply with the data protection and confidentiality requirements of Mauritian law. The documented due diligence covers at least identification and verification of the provider through background screening; whether the provider's risk management, internal controls, information security and data protection capability and security controls are appropriate, taking account of its vulnerability assessment, penetration test, audit and other control findings; how far the provider complies with Mauritian law and with international standards on data protection, confidentiality and information security, the ISO/IEC 27001 standard included; whether the provider is ready and able to keep its commitments when conditions turn adverse, a cyberattack or data theft for instance; and whether it can bring the outsourced systems and services back inside the recovery time objective. The depth of due diligence, audit requirements included, matches the materiality of the services and the reliance placed on the provider.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.