Where an organisation has reason to believe a data breach affecting personal data in its possession or control has occurred it must conduct, in a reasonable and expeditious manner (generally within 30 calendar days per the guidelines), an assessment of whether the breach is notifiable; a data intermediary that has reason to believe a breach has occurred in data it processes for another organisation must notify that organisation without undue delay, and the organisation must then assess; the assessment follows any prescribed requirements and its steps and findings should be documented.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.