Baseline control principles for remediation management (required of every AI (minimum for a low inherent risk)). Issues from cyber risk assessments are prioritised and resolved by criticality within the time frames set in the response to the assessment report; formal processes resolve weaknesses found in penetration or simulation testing; remediation is confirmed by a follow-up vulnerability scan.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.