When preparing an outsourcing tender the B/D defines clearly, with measurable performance indicators, the business and security requirements for the areas outsourced, such as physical security, management responsibilities, incident handling and the security risk assessment and audit regime, includes them in a tailored service level agreement and agrees data ownership with the provider. It understands the consequences of SLA terms on data location, roles and responsibilities, compliance and backup and recovery, modifies the SLA where needed to head off security issues, confirms the terms meet its business and security requirements and, for public cloud, checks the provider's website periodically for changes to common SLA statements that providers may alter with little notice.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.