SIG risk domain V, Cloud Hosting Services. Where the service is cloud hosted, the third party defines accountabilities between parties by service and deployment model and contract, applies the cloud provider's and its own security controls, policies and procedures so data stored and processed meets applicable standards and regulations, and confirms data centre tier, availability and redundancy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.