Intermediate control principles for external connections (required, with baseline, of an AI whose inherent risk is medium). Primary and backup external or third-party connections are monitored and tested regularly (in 2.0 with the provider sharing outcomes and remediation status); a validated asset inventory produces comprehensive diagrams of data repositories, data flows and network infrastructure for those connections; security controls are designed and verified to detect and stop intrusions through them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.