The report must include, as available: the reporter's name and contact details, stating that it is made to satisfy this Security Directive; the affected pipelines or facilities with identifying information and location; a description of the threat, incident or activity with the earliest known date of compromise, the date of detection, who has been notified and what action taken, observed indicators such as malicious IP addresses, domains, malware hashes or samples or abuse of legitimate software or accounts, and known threat source information; the actual or potential impact on IT or OT systems and operations, including service disruption, operational delays and data theft; planned or considered responses, such as reverting to manual backups; and other relevant information. An initial report is due within the deadline even if incomplete, with supplemental information within 24 hours of it becoming available.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.