Guidance for cloud services (Type 1). The CSC should set a topic-specific policy on its use of cloud services, in line with the risk levels it accepts for its information and associated assets, weighing: that information in the cloud environment is open to access and management by the CSP; the assets it keeps there, such as virtual machine instances and cloud storage buckets; processes running on virtualised multi-tenant services; its CSUs' access levels and context of use; its cloud service administrators holding privileged access; where the CSP's organization sits and the countries in which the CSP may store and process CSC data and cloud service derived data, however briefly; and the possibility of unauthorised use of cloud services. The CSP should set rules for providing the service that support CSC security, weighing: baseline security requirements for the service's design and implementation; multi-tenancy and CSC isolation; virtualisation of resources, servers, containers and networks included; CSP staff access to CSC data and derived data; access control procedures such as strong authentication for administrative access; CSC account life cycle management; communication to CSCs during change management; and communication of breaches with information-sharing guidelines for investigation and forensics. Other information: the CSC's cloud policy sits under its top-level policy as one of the topic-specific policies of 27002:2022 5.1; the CSP's rules concern its customers' information and processes, cover the security of the service environment and the functions supporting CSC security, and should meet prospective CSCs' requirements; virtualisation issues affecting CSCs include virtual instance life cycles, use of virtual images, idle or offline instances, snapshot behaviour, self-service portals and hypervisor protection.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.