Every year an entity assesses each cloud arrangement in full, updating and reviews every contract in the register, material or not; reports every contract where contractual requirements were not met; includes CSP information on breaches of data, security or confidentiality for the contract and at CSP level; reports where the CSP has relocated and any approved relocation under the contract; and, for material arrangements, covers performance against the SLA, every monitoring and review exercise by the internal control functions, by regulators or by their staff including for QCB supervision, any case where the CSP did not fully cooperate with QCB, reports relevant to the security and key functions such as internal audit reports, and a CSP report on its security measures (malware defences, cryptography, security testing, technical compliance, key performance and risk indicators). The entity regularly assesses compliance with its global standards policy and uses compliance with that policy and this regulation as a criterion for renewing an arrangement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.