HKMA Cyber Resilience Assessment Framework (C-RAF) 3.6.I: 3.6 Remediation management: intermediate level

What does 3.6.I require?

Intermediate control principles for remediation management (required, with baseline, of an AI whose inherent risk is medium). Simulation testing is repeated to confirm that medium- and high-risk exploitable vulnerabilities are resolved.