16 CFR 318.5(c) FTC notification + 318.6 media notification. FTC NOTIFICATION (318.5(c)): for breaches affecting 500 OR MORE INDIVIDUALS, the entity must notify the FTC IMMEDIATELY + IN NO EVENT LATER THAN 10 BUSINESS DAYS after discovery using the FTC's online notification form at https://www.ftc.gov/health-breach-notification; the notification must include the entity name + contact information + a brief description + dates of breach + dates of discovery + types of information involved + number of individuals affected + steps the entity has taken. ANNUAL LOG (318.5(c)(2)): for breaches affecting FEWER THAN 500 INDIVIDUALS, the entity may keep an annual log + submit the log to the FTC within 60 calendar days following the end of each calendar year (typically by 1 March). MEDIA NOTIFICATION (318.6): for breaches affecting 500 OR MORE INDIVIDUALS IN A STATE OR JURISDICTION + the entity must notify PROMINENT MEDIA OUTLETS serving that state or jurisdiction + the media notice must contain the same content as the individual notice + and may be combined with a press release. SIMULTANEOUS NOTIFICATIONS: the FTC + media notifications must be made AT THE SAME TIME as the individual notification (or within the timelines above for FTC + media).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.