The controller of personal data documents every security incident, including the facts surrounding it, its effects and the measures taken, so that the National Authority can verify compliance with the incident obligations; incidents below the notification threshold are documented as well as those notified.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.