Before a decision to perform a security scan the supervisory authority confirms two things: that the choice of operator and of which systems to scan rests on a risk-based method, and that the scanning methods to be used are appropriate to the risks identified and to the systems concerned. Both the assessment and the decision are documented. The general advice says the operator's importance for important societal functions should guide operator selection, and that system selection should weigh whether a system is sector-critical, its integrations and dependencies, earlier incidents or reported vulnerabilities, internet exposure and its technical risk profile such as known vulnerable technology.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.