From the initial reporting, the covered entity provides the Board with written updates on the cybersecurity incident every 30 days until the incident is fully resolved and documented.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.