The designated provider must obtain a legally binding commitment from the owner of the third-party-owned CII to provide, on request under a Commissioner notice, information on the design, configuration, security and operation of the CII and interconnected owner systems, and to notify it of material changes within 30 days; it must itself furnish that information to the Commissioner on notice and notify material changes within 14 days of becoming aware. Without the commitment the Commissioner may order it to stop using the CII.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.