An entity establishes approved, documented cloud governance policies for decision making and control of cloud risk, built on leading practice, global standards and regulation. The policy defines roles and responsibilities for operating and managing cloud, security controls and risk controls, with the split between entity and CSP clearly defined; sets the process for a risk-based analysis that identifies and classifies the information and technology assets in cloud arrangements by materiality and confidentiality, consistent with the entity's internal risk assessment; requires a maintained asset list for the cloud environment including ownership, security controls and business criticality; establishes strong authentication, access control, encryption of data and the other security and technical controls that meet the entity's requirements and the Sector-Specific Security Regulation; establishes policies, procedures and controls over risk management, CSP due diligence, access and confidentiality; and defines how cloud contracts are reviewed and approved, with the oversight function signing off. The entity defines how the policy applies to each arrangement, builds in its data classification framework and data sensitivity, and adopts a policy naming the global standards that apply and how compliance with them is kept.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.