The processor tells the relevant customer promptly of any unauthorised access to PII, or to processing equipment or facilities, that leads to loss, disclosure or alteration of PII. 2019 guidance, not confirmed for this edition: notification terms and a maximum delay in the contract, information the customer needs to notify authorities, and a record of each breach with its description, period, consequences, reporter, recipients, resolution steps, data affected and notifications made.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.