Understand the specifications of cloud services used; understand the shared responsibility model and clarify responsibilities with the provider; check for misconfigurations such as unintended public exposure, using expert audits or automated misconfiguration detection where needed; check the impact when service specifications change within one's responsibility; identify the many parties involved and build information-sharing and incident response arrangements; and confirm how data on the service is handled (logical deletion) at the end of use (the MIC cloud configuration guideline is the reference).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.