Set and review procedures for monitoring, analysing and reporting signs of attack such as anomalies and indicators of compromise, including cloud services within one's responsibility (confirming the provider's monitoring through its reports); and take monitoring and analysis measures proportionate to the threat, understanding what an outsourced provider actually does and acting where gaps are found.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.