Risk assessment, reviewed at least annually (beyond ISO/IEC 27001). Level 1 (a to c): threat and impact assessment of the cloud environment; assessment covering the scope and context of the cloud service; and identification of risks to assets. Level 2 adds inclusion of data protection and classification risks and backup considerations in the assessment; Level 3 is the same.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.