The CII owner must, when given notice, furnish within the period set the design, configuration and security of the CII and of interconnected or communicating systems under its control, their operation, and other information needed to ascertain the CII's level of cybersecurity; contractual confidentiality is no excuse, and good-faith disclosure does not breach contract.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.