The organization shall set out when sharing cybersecurity information inside and outside the organization is required, allowed or forbidden, taking into account the kind of information, approval, redaction, attribution of the source, the form of communication for each party, disclosure of vulnerabilities, and requirements for handling sensitive information.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.