Intermediate control principles for strategy and policies (required, with baseline, of an AI whose inherent risk is medium). The cybersecurity strategy is aimed at strengthening cyber resilience; a formal cybersecurity programme is in place and built on technology and security industry standards or benchmarks; a formal process updates the policies when the inherent cyber risk profile changes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.