The designated provider must obtain a legally binding commitment from the owner that applicable prescribed technical or other cybersecurity standards will be maintained for the third-party-owned CII; failing that, or if standards are not maintained without reasonable excuse despite directions, the Commissioner may order it to stop using the CII.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.