The owner, operator or CySO must complete a Cybersecurity Assessment by 16 July 2027 and annually (sooner on change of ownership), analysing all networks for vulnerabilities in critical IT and OT systems and the risk of each digital asset, validating the plan, recording recommendations in the security assessment, patching or compensating for known exploited vulnerabilities without delay, and amending the plan; a penetration test with a certifying letter and findings is required with each plan renewal.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.