Information security incidents go through the incident management process, which provides that relevant incidents are reported to the regulatory authorities that legislation and regulations designate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.