The chief executive formally designates a chief information security officer (CISO) to lead information security and a chief privacy officer (CPO) to lead personal information protection, both at executive level with authority to allocate budget and staff, and meeting the legal qualification requirements (PIPA Articles 29 and 31; Network Act Article 45-3, including CISO notification and the bar on the CISO doubling as CIO for large providers).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.