SCI entities (exchanges, clearing agencies, SBSDRs, certain ATSs) remain subject to Reg SCI Rules 1001 through 1007 in addition to the cybersecurity disclosure rule; SCI events may also trigger 8-K Item 1.05 disclosure if the SCI entity is a public registrant.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.