Under the breach notification policies OMB maintains, an agency that discovers unauthorised acquisition of or access to personal information notifies the committees named in section 3554(c)(1) and the Senate and House Judiciary Committees expeditiously and no later than 30 days after discovery, with what it knows about how the breach occurred, an estimate of the number of individuals affected including an assessment of the risk of harm to them, any circumstances requiring delay in notifying individuals, and an estimate of whether and when individuals will be notified.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.