An entity creates a defined cloud computing strategy and reviews it periodically alongside its other strategic reviews. The strategy takes in ICT, information security and the management of operational risk, business continuity and resilience included; the entity defines an implementation plan and architectural roadmap covering the target IT environment, the transition to it and the operating model including organisational change and new skills; allocates sufficient resources to handle all its cloud arrangements; sets policies within the strategy that define acceptable engagements; may adopt a multi-cloud strategy against single points of failure and security risk; keeps the strategy consistent with its overall outsourcing strategy; and remains fully accountable for all regulatory obligations, which it cannot delegate within its cloud arrangements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.