The organization should set and document how assessments are monitored and revised: how often (on a schedule, in response to trigger events, or both), who is responsible, and what the monitoring and review involve. Review outputs should include decisions on opportunities for continual improvement and needed changes in how assessments are planned and performed, changes to risk assessment and risk treatment processes, changes to the objectives for using AI, and changes to the thresholds used to rank impacts for sensitive or restricted uses.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.