Where the Secretary has determined (by notice taking effect at least 30 days later, after consultation and regard to cost and proportionality) that the statutory incident response planning obligations apply, the responsible entity for a system of national significance must adopt and maintain a written incident response plan for responding to cyber security incidents that could have a relevant impact on the system, meeting any rules requirements, and comply with it as varied.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.