Due diligence weighs how the CSP has performed on security policy and awareness, on vetting and risk-assessing its own sub-contractors, on vulnerability assessment and penetration testing, and on refreshing its technology; whether it can bring the outsourced systems and services back within the stipulated recovery time and recovery point objectives; and every zone and location the arrangement touches, never assuming controls are uniform from one location to the next, with the assessment scoped so that enough controls are covered and each relevant location is assessed on its own. The entity makes sure the CSP implements strong authentication, access controls, data encryption and other required security controls, and verifies that the CSP's controls adhere to the QCB Sector-Specific Security Regulation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.