The person in charge of an institution must report a cybersecurity incident to the relevant Sectoral CERT or to the National CERT within not more than twenty-four hours after it is detected; an institution not affiliated to a designated sectoral team reports to the National CERT through the Authority's cybersecurity incident point of contact. The duty is not limited to owners of critical information infrastructure. Failure carries 250 to 5,000 penalty units.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.