Owners of provider-owned CII, designated providers responsible for third-party-owned CII and owners of systems of temporary cybersecurity concern (and, once in force, entities of special cybersecurity interest and major FDI service providers) must comply with the codes of practice and standards of performance issued or approved by the Commissioner that apply to them, from the date their publication notice takes effect, unless waived; codes issued under the former s 11, including the CCoP for CII, are deemed issued under s 35A.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.