Advanced control principles for remediation management (required, with baseline and intermediate, of an AI whose inherent risk is high). Maintenance and repair of organisational assets is done only by authorised people with approved, controlled tools and is logged and reviewed promptly; high-risk issues from penetration or simulation testing, vulnerability scanning and other testing that are not resolved in time go to the board or a board committee for risk acceptance with adequate mitigation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.