A covered entity that experiences a cybersecurity incident (a person has gained unauthorized access to its information system to disrupt, disable, destroy or control it, or to destroy or access its information) that has resulted in a material loss of control, compromise, unauthorized disclosure of data or information, or a similar occurrence must notify the Chair (the Board Chair or designee) as soon as practicable and no later than 24 hours after activating the response procedures in its cybersecurity incident response plan, the documented strategy and procedures to prepare for, detect, respond to and recover from incidents, based on its subsection 3 best practices. Before the 29 January 2026 amendment the limit was written notice within 72 hours of becoming aware of a cyber attack, and an unsuccessful attempt counted; now only gained access does.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.