A person who appears to exercise control over a computer or computer system that the Commissioner believes may meet the CII criteria must, within the period in the notice, provide the information required (the system's function, who and what it serves, its design and anything else needed to assess the criteria); legal privileges and contractual limits on disclosure are respected.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.