Intermediate control principles for threat monitoring and analysis (required, with baseline, of an AI whose inherent risk is medium). Threat intelligence and analysis is assigned to a specific group or person; security processes and technology are centralised in a security operations centre or equivalent (in 2.0 with cyber-surveillance and incident response capability); monitoring runs continuously (24x7 in the 2.0 guide) with adequate support for incident handling.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.