A licensee establishes and keeps a cloud security management framework that lets it mitigate the cyber risk and data vulnerability arising from cloud use. The framework considers at least what the provider discloses about its procedures, controls and audit reviews for managing and monitoring the security of the cloud services and infrastructure, including how shared data is used, stored, transferred and processed; the provider's information on the countries where data is stored and the safeguards there; the provider's assurance that data in transit within its infrastructure, including between data centres in different regions, is secure; third-party assessments of the provider's security and vulnerabilities supplied to the licensee, with the provider's response timeline when a vulnerability is found; the provider's resilience capability, including how fast data can be restored unaltered from backup after an incident or major loss; and the provider's encryption key management, which keeps data segregated, protected and identifiable, with keys and data channels stored separately, weighing the materiality of the assets, the deployment model and the risks.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.