Cloud service customer: confirm the information security roles and responsibilities for the cloud service as described in the service agreement, which can include malware protection, backup, cryptographic controls, vulnerability management, incident management, technical compliance checking, security testing, auditing, collection, maintenance and protection of evidence including logs and audit trails, protection of information on termination of the agreement, authentication and access control, and identity and access management. Cloud service provider: specify in the agreement the relevant information security measures it will implement so that there is no misunderstanding with the customer; these can vary with the type of cloud service used.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.