Intermediate control principles for audit (required, with baseline, of an AI whose inherent risk is medium). The audit function validates that the incident response programme and resilience are commensurate with risk and complexity, reviews management's cyber risk appetite statement regularly, and updates its procedures for changes in the cyber threat landscape across the sector.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.