Where OFCOM consider there is a risk of, or has been, a security compromise, they may direct the provider to take specified steps to inform users (or, in the public interest, the public) of the risk or occurrence and of protective technical measures. The provider must comply within the reasonable period the direction specifies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.