Prior to initiating an action the AG was required to provide a controller or processor 30 days written notice identifying specific violations. If the violation was cured and a written statement provided that no further violations would occur no action could be initiated. This cure period sunset on 1 January 2025 and is no longer available.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.