When signs or occurrence of an incident or personal data breach are recognised, response and reporting follow the defined procedure; data subjects are notified and authorities informed as the law requires; after closure the cause is analysed, reported and shared; and lessons are used to prevent recurrence and update procedures (PIPA Article 34; Network Act Articles 48-3 and 48-4).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.