Run vulnerability assessments and penetration tests regularly, considering risk and system importance, under procedures that set scope (including devices directly connected externally such as VPN appliances), frequency, timing (including before release) and process; for public websites (homepage, internet banking, public APIs) run web application assessments as well as platform assessments; assess mobile applications; for high-risk configurations assess internet-facing servers and core internal devices such as Active Directory and file servers; prioritise findings, set remediation methods and deadlines and track them; and report significant results promptly to management.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.