What does THREAT-AP2 require?

This anti-pattern is present when internet-facing assets are not assessed for cybersecurity vulnerabilities on a periodic basis; to attain the level it must be absent.

Australian Energy Sector Cyber Security Framework...

Other controls in Threat and vulnerability management (THREAT) – Australian Energy Sector Cyber Security Framework (AESCSF)

THREAT-1a THREAT-1a: Vulnerability information sources identified
THREAT-1b THREAT-1b: Vulnerability information gathered and interpreted
THREAT-1c THREAT-1c: Vulnerability assessments performed
THREAT-1d THREAT-1d: Relevant vulnerabilities mitigated
THREAT-1e THREAT-1e: Sources covering higher priority assets monitored
THREAT-1f THREAT-1f: Vulnerability assessments periodic and triggered
THREAT-1g THREAT-1g: Vulnerabilities analysed, prioritised and addressed
THREAT-1h THREAT-1h: Operational impact evaluated before patching

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Energy Sector Cyber Security Framework (AESCSF) controls