The SLA covers the scope of services with a complete definition of each, the delivery metrics and auditing mechanism, both parties' responsibilities and the remedies available when terms are missed, and how the SLA is expected to evolve; it may be off the shelf or negotiated, and public cloud providers often offer non-negotiable SLAs that may not suit mission-critical data, so the subscriber first determines how critical its data and applications are. The subscriber makes sure the SLA states the business level and service level objectives (why the cloud is used before what is used), remediation policies with penalties or incentives, and exclusions and caveats; checks that the objectives are relevant, explicit, measurable, unambiguous and where possible auditable; makes sure the SLA says how issues are identified and resolved, by whom and in what time, what compensation applies and how it is logged and claimed; and scrutinises service credit calculations, asking for worked examples or giving every shortlisted provider the same downtime scenario to compare compensation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.