Entities under Article 16(1) must establish and implement an ICT security testing plan that validates the measures of Articles 33 to 35, 37 and 38 and reflects the threats and vulnerabilities identified under Article 31; review, assess and test security measures according to asset risk; and monitor and evaluate results, updating measures without undue delay for systems supporting critical or important functions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.