A Licensee that acts as an assuming insurer and has no direct contract with the Consumers affected must notify the ceding insurers affected and the Commissioner of its home (domiciliary) state within 72 hours after it determines that a Cybersecurity Event has happened, or within 72 hours after its Third-Party Service Provider tells it of an event in the provider's systems. The ceding insurers, which hold the direct relationship with Consumers, then carry out the consumer notice and the other notification duties of Section 6.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.