Before procuring and deploying cloud services a B/D understands the controls for monitoring and preventing unauthorised access, especially to the privileged accounts the provider offers, and has a mechanism to regain access to a privileged account if a privileged user is locked out. It works with the provider to understand the logical separation that limits data access in a multi-tenant environment, watches the revocation lag between its corporate directory and cloud applications, and for important information uses its own key management or a separate key management service so keys are not shared with the provider; a provider's cloud-native hardware security module may be used if it meets the State Cryptography Administration specifications GM/T 0030, GM/T 0045 and GM/T 0029. These controls apply whatever the cloud model.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.