Baseline control principles for cyber resilience oversight (required of every AI (minimum for a low inherent risk)). Designated management or a board committee is accountable to the board for running the cybersecurity and business continuity programmes; cyber risk comes onto management meeting agendas when a visible cyber event or regulatory alert prompts it, presented by a senior person from technology risk, cybersecurity or information security; cybersecurity resources, tools and staff are budget items reviewed in the periodic budget cycle, with a process to estimate the cost of cyber measures and of losses from cyber incidents; management gives the board or a board committee a written report on the status of the cybersecurity and business continuity programmes at least once a year.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.