The designated provider must secure the owner's commitment to notify it of prescribed incidents affecting the CII or interconnected owner systems (and any type the Commissioner directs) within the prescribed period; must itself notify the Commissioner of prescribed incidents affecting the CII, interconnected owner or provider systems and other provider systems; and must establish the mechanisms and processes the code of practice sets for becoming aware of threats and incidents.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.