The threshold is met where any impact on data availability, authenticity, integrity or confidentiality under Article 5 has or will have an adverse effect on the entity's business objectives or its ability to meet regulatory requirements, or where any other successful, malicious and unauthorised access to network and information systems occurs that may result in data losses. Meeting point (b) together with the critical services condition is on its own enough to make the incident major.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.