Cloud application guidelines or reminders go out regularly so that end users know how sensitive the data is, stay alert to threats and act through the data lifecycle, for instance removing cloud data no longer used or required. Security awareness training is given regularly to internal and external staff, provider subcontractors included, covering government IT security requirements, security risks, incident response procedures and the consequences of disregarding the provider's security requirements; staff responsible for security management and operation ideally hold recognised certificates such as CCSK, CCSP, CISM, CISP, CISSP or ITIL.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.