Per Norwegian PDPA + GDPR Articles 33-34 + 77-84: breach notification + enforcement. Requirements include (a) implement Notification of Personal Data Breaches to Datatilsynet within 72 hours of becoming aware unless unlikely to result in risk + notify affected data subjects where high risk per GDPR Article 34 + (b) operate Security Incident Response Procedures including detection + triage + containment + recovery + lessons learned + (c) operate Complaints Handling and Resolution mechanism enabling complaints to controller + Datatilsynet + (d) maintain Compliance Monitoring and Auditing + Regulatory Reporting and Cooperation + (e) maintain Enforcement and Penalties awareness including administrative fines (up to higher of EUR 20m or 4% global annual turnover) + corrective powers + (f) maintain breach log + incident response + tabletop exercises.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.