Intermediate control principles for threat intelligence sharing (required, with baseline, of an AI whose inherent risk is medium). Management gives business units threat intelligence with business risk context and specific recommendations; a formal, secure process shares threat and vulnerability information with other entities (in 2.0 without breaching privacy law or internal data protection policy); a representative attends law enforcement or intelligence-sharing meetings.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.