Before signing, an entity plans and schedules an initial post-outsourcing implementation review for a time after the material arrangement is implemented. The review assesses the provider's performance and checks that the outsourcing risks are being managed as planned; the entity develops a CSP assessment process with the CSP that for the initial review covers at least contract review, the CSP's self-reported compliance, documentation and policies, available audits and assessments, SLA performance, vulnerability assessments and penetration testing; and the entity obtains the information needed for effective contract monitoring, with the CSP obliged to collaborate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.