A formal reporting route lets staff and external security researchers report suspected incidents. Response policies define what is reported, to whom and when, internally (security leadership, executives, system owners, communications) and externally, including NCSC, ONR and other regulators such as the ICO, the National Cyber Crime Unit or police, and contracting authorities, parent bodies or government departments. Reporting mechanisms ensure compliance with NISR and may be aligned with reporting to other authorities (SyAPs paragraph 198).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.