A qualified person or team produces a threat intelligence report summarising key threats, profiles of the highest-scoring actors, realistic scenarios and actor goals; a medium-risk institution may use a generic Hong Kong banking report prepared within three months before the test, while a high-risk institution needs a report tailored to it from targeted analysis.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.