Controllers and processors must respond to the Attorney General's civil investigative demands and, on a 60-day notice of alleged violations, cure them and provide an express written statement that they are cured and will not recur; breaching that statement or continuing the violation exposes them to suit and penalties of up to $7,500 per violation (trebled if wilful).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.