Baseline control principles for vulnerability detection (required of every AI (minimum for a low inherent risk)). Antivirus and anti-malware tools update automatically; e-mail protection filters common threats such as malicious attachments and links; penetration testing and vulnerability scanning run routinely according to the risk assessment for business systems and internal networks; web-based systems or devices are penetration-tested before launch or significant change. In 2.0 anti-malware is complemented by endpoint detection and response capability.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.