Systems providing cloud services to the public sector meet the measures for their model (SaaS, PaaS, IaaS) in CCN-STIC guides; third-party cloud services used must conform to the ENS or meet a CCN-STIC guide covering penetration testing, transparency, encryption and key management and data jurisdiction; R1 requires services certified under a methodology recognised by the national certification body (and op.pl.5 for security services); R2 applies CCN-STIC secure configuration guides for users and providers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.