The company keeps records of its risk assessments under paragraphs 7 and 8 and reviews them annually for critical national infrastructure and at intervals the appropriate authority notifies for other assessments (as amended from 5 December 2024).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.