Advanced control principles for patch and change management (required, with baseline and intermediate, of an AI whose inherent risk is high). Patch monitoring software on all servers identifies missing patches for operating systems, middleware, databases and other key software; patch reports confirm security patches are tested and deployed within aggressive time frames (for example within 30 days). Change management: the change system has predefined thresholds that decide when a cyber risk assessment of a change's impact is required.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.