CompTIA Security+ (SY0-701) SY0-701 — Question 487

A customer has a contract with a CSP and wants to identify which controls should be implemented in the IaaS enclave. Which of the following is most likely to contain this information?