Have a qualified independent third party perform vulnerability assessments and penetration tests, including smart contract audits where relevant, at least annually and before launching new systems or products; test infrastructure and applications and audit internal and external vulnerabilities regularly and on request, with documented evidence; be audited regularly by independent auditors on processes and regulatory compliance; and, when VARA requires threat-led penetration testing, use a reputable, accredited, insured external tester, cover critical or important functions (possibly in production) and third-party providers, manage testing risks and data, and give VARA the findings, remediation plan and evidence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.