Where the Minister has authorised a specified direction, being satisfied the entity is unwilling or unable to take all reasonable steps to respond to the incident, that the direction is reasonably necessary, proportionate and technically feasible (and not an offensive cyber action or ASD intervention), the Secretary may direct a relevant entity to do or refrain from a specified act within the authorisation's period (up to 20 days, renewable), possibly including disclosing specified personal information with the Privacy Minister's agreement. Breaching the direction is an offence unless the entity took all reasonable steps. Directions prevail over inconsistent programs and obligations; good-faith compliance is protected.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.