At least once a year, or more often if relevant, the manufacturer reports to the approval authority or technical service the outcome of its monitoring activities under 7.2.2.2(g), including relevant information on new cyber-attacks, and reports and confirms that the mitigations implemented for its vehicle types are still effective, with any additional actions taken. The Interpretation Document: the report goes to the authority that granted the approval or the technical service that verified the CSMS, more often when new attacks are observed; ISO/SAE 21434 WP-08-04 and WP-08-06 can form its basis.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.