Every Licensee must notify the Commissioner as quickly as it can, and at the latest 72 hours after determining that a Cybersecurity Event has happened, in two cases: where this State is the insurer's state of domicile or the producer's home state; or where the Licensee reasonably believes the Nonpublic Information involved relates to 250 or more Consumers living in this State and the event either has to be reported to a government, self-regulatory or supervisory body under state or federal law, or is reasonably likely to cause material harm to any of those Consumers or to any material part of the Licensee's normal operations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.