Non-binding VARA guidance on detection and response (behavioural and rule-based transaction monitoring with real-time alerts, internal user and privileged activity monitoring, enhanced monitoring of developer and signing systems, rapid tactical hardening, forensic capability, on-chain tracing with peer collaboration, and full secret rotation and rebuilds after incidents), customer protection (strong customer authentication without instant-messaging verification for high-risk actions, tiered withdrawal limits, cooling periods and graduated approvals, user education, and spreading client assets across cold storage, licensed custodians and distributed infrastructure) and a digital operational resilience testing programme run by independent parties at least yearly on systems supporting critical or important functions, covering vulnerability scans, code reviews, scenario, performance, end-to-end and penetration tests.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.