Report reportable cyber incidents to the National Response Center without delay (from 16 July 2025, unless reported under 33 CFR 6.16-1), develop, maintain and exercise a Cyber Incident Response Plan, validate the plan through annual exercises or incident reviews, and back up critical IT and OT systems with protected, frequently tested backups.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.