The B/D works closely with the provider on incident response, documents how incidents in cloud services are managed and handled, including reporting to GIRO and the follow-up actions the government's incident handling practice guide sets, and establishes an effective mechanism to report, notify, investigate and handle incidents and breaches; the provider reports all security issues to a nominated B/D contact on agreed timing and an internal escalation procedure gives fast response and resolution, with performance metrics set as SLA where needed. The incident response plan is rehearsed, with the provider where feasible, through paper-based exercises, telephone cascades or full rehearsals, and improvements are written into the next version of the plan.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.