ISO/IEC 27002:2022 control 5.24 applies, with telecommunications guidance: set criteria for judging whether an issue raised by a customer is an information security incident, and escalate those that break the agreed service level or disturb how customers and staff run existing configurations; put into incident response procedures the criteria and timing for telling customers; make sure every customer knows the escalation procedures and can get the documentation; and rank customer-raised issues by criteria such as customer PII having been compromised, a site being wholly down or missing its SLA, major impact (systems down, packet loss, latency), degraded service, and customer requests. Because it supplies an important utility, the organization should set up mechanisms and procedures to detect and analyse incidents quickly and correctly and to contain them, remove their cause and recover: report to the right people internally and to outside bodies such as regulators, emergency services and critical infrastructure parties; isolate the affected system, taking it out of use or disconnecting it from operational networks before powering it up again if it is to be examined; and on recovery, confirm the affected systems work normally, adding monitoring for related activity where needed. Incident information should be shared with relevant bodies such as a Telecom-ISAC.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.