A B/D checks a cloud service against globally recognised standards, such as ISO 27001, ISO 27017, ISO 27018 and a SOC 2 Type 2 report, and against nationally recognised schemes where they apply, such as TRUCS, ITSS and the Mainland multi-level protection scheme; it may use the Cloud Security Alliance consensus assessments questionnaire as a reference set of questions. It asks the external provider for its compliance certificates and reports, verifies that they are valid and, once confirmed, uses them to assess the security and compliance of the provider's infrastructure, service and controls.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.