Where a security compromise occurs, the provider must take appropriate and proportionate measures to prevent adverse effects arising from it (on the network or service or otherwise) and, where it has an adverse effect on the network or service, to remedy or mitigate that effect. Regulations may specify measures to be taken (s.105D, used in SI 2022/933).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.