A controller must establish a conspicuously available internal appeal process, with the same ease-of-use as request submission, for refusals to act on rights requests; within 45 days of receiving an appeal (extendable by 60 days with notice and reasons) it must inform the consumer in writing of its decision and reasons and clearly and prominently explain how to complain to the Office of the Attorney General, and it must keep records of all appeals and responses for at least 24 months and compile them for the attorney general on written request in an investigation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.