The board makes sure governance practices secure the reliability and resilience of the ICT operating environment; board and senior management may include members who understand and manage technology and cyber risk; senior management is responsible for assessing, understanding and monitoring CSPs for material services; management feeds the board information that is clear and consistent, robust, on time, well aimed and carries enough technical detail for real oversight and challenge; the entity stays fully accountable for its regulatory obligations; it sets how much cloud risk it will accept and tolerate; and it either stands up a function to oversee its internal and external cloud arrangements or hands that responsibility to an existing one.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.