A security incident is any confirmed adverse event affecting the confidentiality, integrity, availability or authenticity of personal data. It may cause relevant risk or damage, and so must be communicated, when it may significantly affect data subjects' interests and fundamental rights (for example by preventing the exercise of rights or use of a service, or causing material or moral damage such as discrimination, physical harm, damage to image and reputation, financial fraud or identity theft) and, at the same time, involves at least one of: sensitive data; data of children, adolescents or older people; financial data; system authentication data (logins, tokens, passwords); data protected by legal, judicial or professional secrecy; or data at large scale (a significant number of data subjects, judged also on volume, duration, frequency and geographic reach).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.