An entity integrates its cloud arrangements into its business continuity plans; details in its IT disaster recovery plan how to switch to the cloud disaster recovery environment and back to normal cloud production; assesses its ability to find alternate vendors, rating how easily each CSP could be replaced (easy, difficult or impossible) and naming an alternate provider where possible; evaluates the CSP's continuity plan against required standards; satisfies itself that interdependency risk from cloud outsourcing can be mitigated; weighs how likely an unexpected disruption is and what it would cost; proactively seeks assurance on continuity preparedness; integrates the CSP into its continuity tests and regularly updates and tests the arrangements with the CSP; and has a defined incident response plan whose crisis communications are joined up with the CSP.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.