Hold professional indemnity, directors' and officers', commercial crime (or similar) cover for virtual assets in hot wallets and any other cover VARA specifies, adequate to the business and with a regulated insurer; group policies must name the firm and its cover level, and VARA may accept alternative protection for proven reasons.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.