Once aware of a Cybersecurity Event affecting a system maintained by one of its Third-Party Service Providers, the Licensee handles the event just as 6A requires. Its time limits start on the day following the earlier of the provider's notice to it or the Licensee otherwise gaining actual knowledge. Nothing stops Licensees, providers and other parties from agreeing among themselves who will investigate or give notice.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.