Advanced control principles for secure development (required, with baseline and intermediate, of an AI whose inherent risk is high). A risk-based information assurance function evaluates internal application security; for high-risk applications, static code analysis findings are fixed before new or changed code goes to production and code reviews cover internally developed and vendor-built custom applications; all interdependencies between applications and services are identified and reviewed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.