Advanced control principles for governance and preparation of incident response and recovery (required, with baseline and intermediate, of an AI whose inherent risk is high). Methods for responding to and recovering from cyber incidents are woven through business units' disaster recovery, business continuity and crisis management plans; several systems, programmes or processes form a comprehensive cyber resilience programme to sustain and recover operations across a range of disruptive and destructive incidents; a process continuously improves the incident response plan to recover services, assure data integrity and recover lost or corrupted data; in 2.0 qualified third parties may assess from an attacker's perspective how the institution's assets could be targeted, with fail-safes for dependencies on third parties during response and recovery, and resilient, geographically diversified architecture avoids concentration risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.