Guidance for cloud services (Type 1). The CSC should define the information security roles and responsibilities for its use of cloud services, write them into its topic-specific policies and procedures, assign them, and tell the CSUs concerned. The CSP should define and assign the information security roles and responsibilities that relate to providing its cloud services. Other information: ISO/IEC 22123-3 defines the roles and sub-roles of CSC and CSP. (The first edition's agreement on the split between customer and provider no longer sits here; the shared allocation is the subject of the CLD control 5.38.)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.