A security risk assessment is performed before a cloud system or application goes into production and before major enhancements or changes, the risks in the cloud are evaluated, controls implemented and their effectiveness reviewed periodically and enhanced as new technologies allow, with knowledge of the provider's security implementation obtained where a required control sits on the provider's side. Assessment is ongoing: for private cloud the frequency follows IT security policy; for public cloud the B/D makes sure the provider's third-party auditor assesses regularly at a frequency aligned with the B/D's policy or mutually agreed, for example annually or every two years by system criticality.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.