On a severe security incident (for high level, any unauthorised use or integrity damage; for medium level, one affecting a substantial part of the database) the controller notifies the Registrar immediately and reports the measures taken; the Registrar may, after consulting the National Cyber Directorate, order notice to data subjects who may be harmed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.