Advanced control principles for ongoing monitoring of third-party risk (required, with baseline and intermediate, of an AI whose inherent risk is high). Periodic on-site assessments or reviews of independent auditor reports (for example SOC 2 Type II) confirm, risk-based, that appropriate cyber controls are in place; third-party staff access to sensitive or critical data on institution-hosted and third-party-hosted systems is tracked actively on least privilege.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.