The organisation must run an information security reporting system that meets Regulation (EU) No 376/2014 where that Regulation applies to it and, without prejudice to it, must report to its competent authority any incident or vulnerability that may represent a significant risk to aviation safety, also to the design approval holder where an aircraft or associated system or component is affected and to the organisation responsible for the design where a system or constituent it uses is affected. The sequence is a notification as soon as the condition is known, a report in the authority's form with all relevant known information as soon as possible and within 72 hours of the condition becoming known unless exceptional circumstances prevent it, and a follow-up report, as soon as the actions are identified, giving the recovery actions taken or intended and the actions to prevent similar incidents. Under Article 5 this point must be met even by organisations otherwise relying on the equivalence of Regulation (EU) 2015/1998 or the EGNOS security rules.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.