A person who makes a public disclosure qualifies for protection where they first reported internally and externally (or directly externally) without appropriate action being taken within the prescribed timeframe, or where they have reasonable grounds to believe the breach may present an imminent or manifest danger to the public interest, or that external reporting risks retaliation or is unlikely to be effectively addressed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.