Carried first-edition guidance (first-edition 9.1.2 on network and network service access, which 27002:2022 folds into 5.15). The CSC's access control rules for network services should state, for every cloud service it uses, the requirements for user access to that service. No first-edition guidance for the CSP.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.