FCC CPNI recordkeeping requirements aggregate from multiple sections: (a) Section 64.2009(b)/(c) - 1-YEAR retention of marketing campaign records (description of each campaign + CPNI used + products/services offered) + supervisory review records; (b) Section 64.2010 - records of customer authentication + account access events (industry practice typically 1-2 year retention); (c) Section 64.2011(d) - 2-YEAR retention of CPNI security breach records (all reports + dates + remediation steps); (d) Section 64.2009(e) - annual certification + supporting evidence retained for FCC examination periods (typically aligned with FCC statute-of-limitations + enforcement-action recordkeeping ~5-10 years); (e) consent records under Section 64.2004/64.2007/64.2008 - retained for the duration of customer relationship + reasonable period after relationship ends to support enforcement defence. Industry best practice retention: 7-10 years for consent records + 5 years for marketing + 2-3 years for breach + 1-2 years for routine authentication logs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.