Baseline control principles for communication and improvement (required of every AI (minimum for a low inherent risk)). Channels let staff report cyber events promptly; criteria escalate incidents or vulnerabilities to senior management by impact and criticality; procedures notify customers, regulators and law enforcement as required when sensitive customer information is accessed or used without authorisation; regulators, law enforcement and service providers are notified of unauthorised system access or incidents that could degrade services; incidents are classified, logged and tracked; a process reaches the people who analyse and respond; an annual report of cyber incidents or violations goes to the board or a board committee; potentially affected third parties are notified. In 2.0 a list of internal and external stakeholders to inform is defined by scenario and criteria.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.