Where an incident is reportable but not Priority 1, the provider gives the Commissioner a written notice in approved form within 30 days of becoming aware, with the same content as a Priority 1 notice (actions taken rather than first actions), and supplies any further specified information within the time set. Priority 2 includes incidents that could reasonably have been expected to cause harm.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.