An entity remains accountable for key management and makes sure the CSP executes the applicable Sector-Specific Security Regulation requirements whether keys sit in the CSP's data centre or on the entity's premises, provided the cryptographic controls meet the applicable standards; it makes sure the CSP keeps records and documentation of the required security controls, monitors regularly that they are in place, and tracks any change to them; a key management access procedure is documented and implemented; the CSP opens key management system access only to named individuals, only for as long as a task takes, under the agreed procedure; least privilege governs access granted to the CSP; and the entity retains the right to all logs generated by the procured services, including a full record of every CSP access request to the key management system.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.