The provider keeps change logs for all changes to virtual machine images whatever their state; separates production from non-production environments; uses secured, encrypted channels and where possible a segregated network when migrating servers, applications or data to virtual servers; maintains a formally defined, periodically reviewed user access management process; lets only authorised people and applications reach diagnostic and configuration ports; segregates duties so conflicting functions do not sit with one person; validates user access at planned intervals and on identified violations with remediation under its access policies; deletes accounts promptly when users leave; submits a documented business continuity plan; performs business impact analysis of key processes; performs periodic risk assessment of assets supporting critical processes; maintains an escalation plan with activation conditions; gives each continuity plan an owner; and defines, communicates and periodically reviews the roles, responsibilities and contacts for executing continuity and disaster recovery plans.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.