Extend assessments and tests to VPN networks not directly connected to the internet and to the internal environment; run threat-led penetration testing (TLPT) regularly, choosing qualified providers after background checks on testers, using techniques at the level of real attackers based on threat intelligence, testing severe but plausible scenarios affecting services, evaluating the blue team's response (defence, detection, reporting, containment), testing in production without notice to the blue team, and reporting issues to management for improvement (referring to the FSA's 2018 TLPT report, FISC's 2019 TLPT handbook and the FSA's June 2024 system failure report); have internal staff who know the environment run penetration tests including red teaming; and review test methods and results regularly and consider rotating test vendors for a fresh independent view.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.