Baseline control principles for audit (required of every AI (minimum for a low inherent risk)). Audit or review evaluates, risk-based, the policies, procedures and controls for significant cyber risks, including those in new products, emerging technologies and information systems; the audit function validates the controls over storing or transmitting confidential data, and validates that cyber risk management, threat intelligence collection and collaboration, and cybersecurity controls are each commensurate with the institution's cyber risk and complexity; a formal process updates audit procedures when the inherent cyber risk profile changes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.