The FI should conduct regular vulnerability assessment of its IT systems at a frequency commensurate with criticality and exposure, addressing risks promptly; the scope should include at least vulnerability discovery, weak security configurations, open network ports and application vulnerabilities, with checks for common web vulnerabilities on web-based systems.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.