Before the service is adopted, compliance with the government's security regulations and policies is checked and written into the contract and SLA, together with the deliverables the provider supplies for checking: for instance its security policy, its contingency plan with test reports, its incident response procedures, its security audit reports, its authorisation reviews, a duties segregation matrix, awareness and training records, baseline configuration standards, its configuration management plan and the results of its periodic reviews. The provider assists the B/D's onsite security audit of its data centres by a team drawn from IT, security, continuity and physical security disciplines, supplying its business continuity and disaster recovery plans, relevant certifications such as ISO and ITIL, audit reports and test plans before the visit.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.