For all ICT assets, entities under Article 16(1) must manage the asset lifecycle; check whether assets are supported by their ICT third-party providers; identify capacity needs and prevent shortages; run automated vulnerability scanning and assessment proportionate to classification and risk and deploy patches; manage risks of outdated, unsupported or legacy assets; log access control, ICT operations including system and network traffic, and change management events at a level of detail fit for purpose; monitor and analyse anomalous activity for critical or important operations; follow current cyber threat information; and detect information leakage, malicious code and known software and hardware vulnerabilities and check for security updates.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.