A subscriber applies a risk management approach to choosing its provider, so that the security and privacy risks of externalising IT resources are understood and addressed before cloud options are adopted; the approach conforms to MCMC MTSFB TC G009, follows the risk management steps that the following clauses expand, is not treated as a one-pass waterfall and is aligned with ISO 31000.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.