The manufacturer must publish, for the product's hardware, software pre-installed when it is supplied to a consumer, software that must be installed for all of the manufacturer's intended purposes, and software used for or in connection with any of those purposes, at least one point of contact through which a person can report security issues to the manufacturer, and when a person who reports will receive an acknowledgement of receipt and status updates until the reported issues are resolved (Schedule 1 clause 3(1), (2)). The information must be accessible, clear and transparent and available without prior request, in English, free of charge and without asking for the person's personal information (clause 3(3)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.