An entity that is, or will be, a reporting entity for a critical infrastructure asset to which Part 2 applies at the end of the asset's grace period must give the Secretary, in the approved form, by the later of the end of the grace period and 30 days after becoming a reporting entity: as responsible entity, the operational information (s 7: location, area serviced, identity and incorporation of the responsible entity and each operator, the CEO's name and citizenships, operating arrangements, and arrangements for maintaining prescribed data, which the Definitions Rules extend to personal information of at least 20,000 people, sensitive information, research and development, operating systems, risk management and continuity information and consumption data); as direct interest holder (s 8: at least 10% with associates, or a position to influence or control), the interest and control information (s 6: identity, type and level of interest, influence or control, board appointees' access to operating systems, and every entity able to influence or control it up the chain). Information that cannot be obtained despite best endeavours is excused (s 25); agents may give it (s 30), and executors, administrators and insolvency practitioners must give it for entities that die or fail (ss 28, 29). Part 2 applies to the assets in s 18A and the Application Rules.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.