Advanced control principles for staffing and training (required, with baseline and intermediate, of an AI whose inherent risk is high). A programme covers recruitment, retention and succession for cybersecurity and resilience staff; dedicated cyber staff develop or contribute to integrated enterprise security and cyber defence strategies; candidates' background checks cover employment history and references in proportion to data sensitivity, business need and risk; a training policy keeps security staff training current with new threats; directors receive training on how complex products, services and business lines affect cyber risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.