The data controller must maintain a data breach management and response plan covering identification and escalation, roles (including the DPO), containment and mitigation, the notification decision, communications to the Commissioner and data subjects, and post-incident review, with periodic training and simulations; contractually oblige its data processors to notify it promptly of a breach and give all reasonable assistance (s. 12B does not bind processors directly); and, on a breach, investigate the cause, contain it (isolate systems, suspend access, stop the causing practice, recover data), assess weaknesses and take corrective and preventive action.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.