An entity performs due diligence on the CSP whether the contract is direct or runs through a broker or intermediary, assessing the prospective CSP and the appropriateness of the services for the intended use, with a clear documented business case or rationale for using the cloud. The due diligence weighs data confidentiality, security maturity and financial, operational and reputational factors; considers how the data in scope is classified and how sensitive it is before any arrangement; scales its depth to the criticality and materiality of the arrangement; and leads to risk-mitigating controls that match that criticality and materiality, with controls specific to the SaaS, PaaS or IaaS model deployed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.