The covered entity performs, or has a third party perform, an investigation into the cybersecurity incident, prepares a report documenting its results, notifies the Board when the report is complete and makes it available for Board review on request. The report must include at least the root cause, the extent of the incident and the actions taken or planned to prevent similar incidents in future.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.