SIG risk domain J, Cybersecurity Incident Management. The third party runs a formal incident management program covering the lifecycle of detection, analysis of indicators of compromise, containment, response and notification, with defined and regularly tested escalation, reporting and resolution procedures and criteria for notifying clients, users, employees or authorities, including mandatory regulatory reporting.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.