An entity aims for enforceable contractual rights that give it the same access as if it managed the cloud environment directly; makes sure QCB can audit exactly as it could had the function stayed in house; has reasonable access to the information needed for any investigation arising from a cloud incident or an audit inspection, so far as other legal obligations allow; makes sure neither it nor its auditor faces any cap on requests for access to or delivery of data; has access to information on the controls applied at the business premises in scope; can visit the relevant premises as the CSP permits; and makes sure QCB has the right to access business premises and communicate with the CSP as the CSP permits.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.