Intermediate control principles for communication and improvement (required, with baseline, of an AI whose inherent risk is medium). Staff essential to mitigating the risk (for example fraud and business resilience) know their escalation roles; a communication plan notifies other organisations, including third parties, of incidents that may affect them or their customers; an external plan covers media notification where applicable; tracked incidents are correlated for trend analysis and reporting; in 2.0 the incident response team coordinates internal and external communication through the established channels.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.