Selection rests on the provider that best meets the risk tolerance set during the risk process. The provider chosen for a workload must not prevent the subscriber from complying with local and international law such as the Personal Data Protection Act 2010 and the GDPR; must support features that help the subscriber mitigate the risks it owns; may support modern security architecture such as micro-segmentation and zero trust; and must be compliant with ISO/IEC 27001 and with ISO/IEC 27017 and 27018 for cloud and privacy controls, or an equivalent certifiable industry standard.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.