Control: the processor tells the relevant customer promptly of any unauthorised access to PII, or to processing equipment or facilities, that leads to loss, disclosure or alteration of PII. Guidance: breach notification terms belong in the contract, which says how the processor supplies what the customer needs to notify authorities, excludes breaches caused by the customer or principal or in components they are responsible for, and sets the longest acceptable delay. For each breach a record is kept of: what happened; the time period; the consequences; who reported it and to whom; the steps taken to resolve it, including who was in charge and what data was recovered; the fact that PII was lost, disclosed or altered; the data affected where known; and any notifications made to the customer or regulators. Some jurisdictions make the processor notify the authority itself. Note: other notifiable breaches, such as collection without consent or use for unauthorised purposes, are outside this control.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.