In electronic form and as the Commissioner directs, the Licensee supplies as much of the following as it can: when the event happened; how the information came to be exposed, lost, stolen or breached, including what part any Third-Party Service Provider played; how the event was found; whether any information was got back and by what means; where the event came from; whether it was reported to police or notified to any regulator, government body or law enforcement agency, and when; exactly what kinds of information were taken; how long the compromise lasted; how many Consumers resident in the State were affected (a best estimate, revised in each report); what any internal review found about failures of automated controls or internal procedures; the remediation undertaken; a copy of its privacy policy and a description of how it will investigate the event and tell affected Consumers; and a person to contact. The Licensee must keep updating and adding to its notifications as matters develop.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.