A person controlling a computer or computer system the Commissioner believes may meet the temporary-concern criteria must provide the requested information, and once designated the owner must furnish on notice the design, configuration, security and operation of the system and interconnected owner systems and any other information needed to assess its cybersecurity; contractual confidentiality is no excuse.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.