A notification must carry all information reasonably necessary for the Secretary to assess the change and, so far as reasonably practicable: a risk assessment of the change covering, where relevant, material risks and supply chain, physical security and natural, personnel, and cyber and information hazards; written evidence that the entity evaluated how controls could minimise or eliminate those hazards and risks and assessed the material risks of other ways of achieving the project outcome; details of all hardware and software introduced, used, changed or affected, including operating system versions and other major software components; details of every major supplier relevant to the project, including contracts or outsourcing arrangements for each new hardware, software or third-party service element; schematics and system documentation describing interfaces with existing asset elements, security controls, how business critical data used by any new computer is used or stored, and network-to-network interfaces with third-party systems; a timeline of planning, development and implementation; and any other relevant information.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.