Intermediate control principles for cyber resilience oversight (required, with baseline, of an AI whose inherent risk is medium). A cyber risk appetite statement is approved by the board or a board committee; the board or committee reviews and approves the cybersecurity programme at least annually; management or a dedicated committee owns compliance with cyber legal and regulatory requirements; cyber risks beyond appetite are escalated to management or that committee; the board or committee approves management's prioritisation and resource allocation based on the cyber risk assessment results; the written status report to the board or committee becomes at least quarterly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.