Establish and document that a cloud service exhibits the two consumer-facing essential characteristics defined in NIST SP 800-145 Section 2: On-Demand Self-Service (a consumer can unilaterally provision computing capabilities such as server time and network storage as needed automatically without requiring human interaction with each service provider) and Broad Network Access (capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms such as mobile phones, tablets, laptops, and workstations). Capture evidence in the cloud service catalogue, the cloud procurement scoring sheet, and the architecture decision record that confirms self-service portal or API exists and that platform-agnostic protocols (HTTPS REST, OAuth, OIDC) are supported.
This control maps to 17 controls across 14 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 17 it maps to, and the evidence behind each claim, over MCP and REST.