Baseline control principles for secure development (required of every AI (minimum for a low inherent risk)). Developers follow secure coding practices meeting industry standards; on a risk basis, security controls of internally developed software are reviewed and tested periodically and reviewed before code moves to production; the need to hold intellectual property and production code in escrow is assessed; security testing runs at unit, system integration and user acceptance testing, including mobile applications. 2.0 adds a documented SDLC framework with security embedded in each phase and testing of application programming interfaces (levels not stated in the sources).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.