In order to correctly complete an SSP, for say, a SaaS csp, wouldn’t you need the CRM for the IaaS it’s hosted on to correctly complete the control narratives? Where the csp has inherited some controls, you indicate that, but where they have responsibility for others, you describe how you implemented the ones you are responsible for.