Because an off-premises data centre may put cost ahead of security, a B/D validates the operating effectiveness of facilities such as uninterruptible power, air conditioning and ventilation, fire suppression and water and flood control against recognised standards (the ISO information security and energy-utility standards, the Mainland GB/T 22239 baseline, the multi-level protection scheme and the like), assesses the location of data centres and disaster recovery centres for natural hazards, local jurisdiction and network dependency, and, where on-site inspection is not feasible, reviews independent third-party annual audit reports to confirm the physical controls meet certification requirements such as ISO 27001 or SOC 2 Type 2.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.