Objective ISO/IEC 27002 12.1 applies. Control, in substance: administrative operations in the cloud environment are to follow procedures that are set down in writing and whose execution is watched. Cloud service customer: document procedures for critical operations where a failure can cause unrecoverable damage to assets in the cloud environment, such as installation, change and deletion of virtualised devices (servers, networks, storage), termination procedures for cloud service usage, and backup and restoration, and specify that a supervisor monitors these operations. Cloud service provider: provide documentation about critical operations and procedures to customers who require it. Other information: rapid provisioning and on-demand self-service mean administrators on both sides perform such operations, and because human error in them can cause serious incidents (erasing or shutting down many virtual servers, destroying virtual assets) mechanisms to safeguard them should be considered and implemented where needed.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.