Operate detection + logging + IR + breach notification + fraud detection per NRF framework + NIST SP 800-61 + state breach notification laws + PCI DSS incident response + brand operating rules. Logging and detection must (a) collect logs from POS + e-commerce + payment processing + IAM + endpoint + network + cloud + mobile app + in-store IoT + loyalty + customer service applications with retail-aware correlation rules, (b) deploy detection rules covering retail-specific patterns (skimming + form-jacking + account takeover + credential stuffing + return fraud + chargeback abuse + gift card fraud + insider misuse + ransomware staging), (c) integrate threat intelligence from R-CISC / RH-ISAC + payment brand fraud feeds + commercial threat intelligence. Incident response must (a) maintain IR plan covering retail scenarios with cross-functional team (cyber + privacy + payments + legal + comms + customer service + store operations + loss prevention + executive leadership + brand/marketing), (b) coordinate with payment brands per their operating rules (Visa CISP + Mastercard SDP + AmEx EISP + Discover DISC + JCB-DSP) on cardholder data incidents, (c) maintain forensic readiness + chain of custody + investigator contracting for PFI (PCI Forensic Investigator) engagement. Breach notification must (a) maintain matrix of applicable laws across all 50 US states + DC + territories + international jurisdictions with timing + content + recipient requirements per law, (b) trigger notification clocks at awareness per applicable law (some 30 days some 45 some 60 some 72 hours + GDPR 72 hours + similar), (c) coordinate with state AGs + federal regulators + payment brands + insurance + customers + employees + investors + boards. Fraud detection and prevention must (a) operate real-time fraud detection across digital channels (e-commerce + mobile + buy-online-pickup-in-store + curbside), (b) operate physical fraud prevention in stores including return fraud + sweet-hearting + employee fraud, (c) integrate fraud + cybersecurity functions where compromise enables fraud.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.