Advanced control principles for cyber resilience oversight (required, with baseline and intermediate, of an AI whose inherent risk is high). The board or a board committee has cybersecurity expertise or engages experts to support its oversight; it has a process to make management act on changing cyber risks and significant cyber issues; management has a formal process for continuously improving cyber oversight; business units are held accountable for managing the cyber risks of their activities; requests for more cybersecurity staff and tools are built into business-unit budgeting and aligned with the cybersecurity strategy; the standard board pack carries reports and metrics that go beyond events and incidents to cyber threat trends and the institution's security posture.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.