An entity sets out the rights and obligations of itself and its CSP in a written agreement, directly or through an intermediary, which expressly allows the entity to terminate where necessary and includes clauses that keep data confidential, available and intact at all times according to the service. For a material arrangement the agreement addresses at least a clear statement of what function is outsourced; enforceable and measurable SLAs that define the governance for managing the contract and the management information and deliverables that governance relies on; start and end dates and notice periods for both parties; who the parties are to each other and what each owes; ownership and control of IT assets, with any control granted to the CSP defined; information security and personal data provisions proven to satisfy Law No. 13 of 2016 and the Sector-Specific Security Regulation; the CSP's grant of access to data and business premises and audit rights to the entity, its competent authorities and their appointees; the entity's right to monitor, review and audit the arrangement, including for QCB supervisory reviews; receipt of reports relevant to the security and key functions such as the CSP's internal audit reports; detailed cyber security data from the CSP covering its malware defences, cryptography, security testing, technical compliance and its key performance and risk indicators; whether and under what conditions sub-contracting is permitted; incident management with reporting to the entity without undue delay of incidents affecting its operations or service; digital forensic evidence generation, including original versus copied evidence and chain of custody prerequisites; and e-discovery costs and forensic requirements including cost and response times.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.