The owner must notify the Commissioner, in the prescribed form and period after becoming aware, of prescribed cybersecurity incidents affecting the CII, any interconnected or communicating system under its control, any other system under its control, and any interconnected or communicating system under the control of its supplier (the last two added in 2024), plus any other incident type the Commissioner specifies by direction; and must establish the mechanisms and processes for detecting threats and incidents that the applicable code of practice sets out.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.