Cloud service customer: no additional guidance. Cloud service provider: where it uses cloud services of peer cloud service providers, ensure that information security levels for its own customers are maintained or exceeded; where it provides a service based on a supply chain, give information security objectives to its suppliers and require each of them to perform risk management activities to achieve those objectives.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.