A B/D stays accountable for the security of its data: it brings a cloud strategy into its information systems strategic plan or IT plan on a risk basis, adopts and enforces security management practices and controls, monitors its information assets and keeps policies, guidelines and procedures that preserve confidentiality, integrity and availability. For outsourced private and public clouds it counters lock-in by applying good practice for data backup, deletion and portability, by making sure the chosen provider offers workable ways to migrate out, and by working with several providers so that data portability and configurations are tuned for migration.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.