The roles and responsibilities of everyone who supports the operation and security of the cloud services, in the B/D and at the provider, are defined and documented, for example in the service level agreement, above all for data centres in an outsourced multi-tenant environment. The B/D requires the provider to make sure the employees and contractors who handle systems holding government data are suitable for their roles, to segregate duties so that no one person performs both system administration and security administration, and to enforce need to know strictly; it keeps the contact details of the responsible supervisory authorities current.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.