Intermediate control principles for vulnerability detection (required, with baseline, of an AI whose inherent risk is medium). E-mails and attachments are scanned automatically and blocked when malware is present; audit or risk management reviews simulation testing scope and results to decide whether to rotate testing firms; threat intelligence is used to design iCAST scenarios. In 2.0 simulation testing is done regularly or after significant change that raises risk, with defined scenarios, scopes and cases (marked intermediate in the 2.0 guide).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.