It is Federal policy that ICT service providers contracting with agencies must promptly report to those agencies when they discover a cyber incident involving a software product or service provided to them, or a support system for such a product or service; the contract language recommended under 2(g)(i) sets graduated reporting periods by severity, with the most severe incidents reported no later than 3 days after initial detection.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.