A Federal, State, local or Tribal government may not use information about a covered cyber incident or ransom payment obtained solely through direct reporting to CISA to regulate (including by enforcement) the reporting entity, unless that government expressly allows CISA reports to meet its regulatory reporting obligations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.