The institution draws up an improvement plan and timetable to close every gap found, endorsed by management with the assessment results; the board and senior management put in place governance and processes to reach the resilience level its risk profile requires, monitor implementation closely and keep the board informed, and continue to evaluate whether controls remain adequate against the C-RAF and the current cyber risk landscape.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.