In the course of the investigation the Licensee, or someone it designates, establishes as far as it can: whether a Cybersecurity Event actually took place; what kind of event it was and how far it reached; which Nonpublic Information, if any, could have been affected; and it carries out or supervises reasonable steps to make the compromised Information Systems secure again, so that no more Nonpublic Information is acquired, released or used without authorization.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.