Carried first-edition guidance. The CSC's inventory should take in the information and associated assets it keeps in the cloud environment and show where each is maintained, for instance by naming the cloud service; the CSP's inventory should single out CSC data and cloud service derived data. Recording derived data that a service adds to CSC data as an asset strengthens its protection. The first edition also noted, as information only, that who owns application software depends on the service category: the CSC under IaaS or PaaS, the CSP under SaaS.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.