Extends ISO/IEC 27002:2013 16.1.1. Every information security incident leads the processor, inside its incident management process, to check whether PII has been breached (the text refers to A.9.1, the first edition's number for the breach notification control, A.10.1 here). An information security event does not have to trigger that review: an event is something that neither causes nor makes significantly likely any unauthorised access to PII, or to the equipment or premises where the processor stores PII; typical examples, not an exhaustive list, are pings and other broadcast attacks against firewalls or edge servers, port scanning, failed attempts to log on, packet sniffing and denial of service.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.