The service auditor gets and reads the description and assesses whether the aspects within scope are presented fairly. This includes assessing whether the control objectives stated are reasonable in the circumstances, whether the controls described were actually implemented, whether complementary user entity controls are described adequately, and whether the services of any subservice organisation are described adequately, with a statement of which method, inclusive or carve-out, applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.