The designated provider must comply by the deadline with the Commissioner's written directions on threats, codes and standards, steps to require the owner to maintain prescribed standards, appointment of an approved auditor, or other matters needed for the third-party-owned CII's cybersecurity.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.