A carrier that is the responsible entity for a critical telecommunications asset must, as soon as reasonably practicable after becoming aware that a change or proposed change to a telecommunications service or system is likely to have a material adverse effect on its capacity to protect the asset for security, notify the Secretary in writing, specifying the asset, describing the change and giving prescribed information (under the 2025 Rules, all information reasonably necessary, including a risk assessment across material risks and hazards). Covered changes include new services, moving or procuring notifiable equipment (including offshore), outsourcing service provision or management or management of customer information, and offshore access to or storage of protected information and retained data. The Secretary may, within 22 business days, require further information within 44 business days (which must be given), and must then advise whether there is a risk prejudicial to security and may suggest mitigations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.