Regulation 11 also requires the database owner to maintain an internal register of every security event, severe or not. The register must record the event, its handling, and corrective measures. The database manager must review the register periodically and trends must inform the risk assessment and definition document.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.