The vendor should confirm to the reporter, promptly and within the period its disclosure policy announces, that a report has been received, so the reporter knows it arrived and is in hand; this confirmation comes before, and is separate from, telling the reporter what verification found (ISO/IEC 30111 7.1.4 f). The UK PSTI regulations require a manufacturer relying on this paragraph to publish when a reporter will get that acknowledgement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.