Medium- and high-risk issues from penetration testing, vulnerability scanning and other independent testing that are not resolved promptly are escalated to the board or its committee for risk acceptance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.