An MCDA defines clearly the split of information security responsibilities between itself and the provider so that every aspect is covered without ambiguity; implements security measures addressing the threats specific to the service category (IaaS, PaaS or SaaS) and to the deployment model; catalogues its data and identifies its sensitivity and the business risk of leakage, loss or corruption as the information security standard describes; and where encryption is used defines responsibility for key management clearly and keeps both logical and physical control over keys and data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.