A processor must regularly conduct compliance audits of its personal information processing against laws and administrative regulations; the Administrative Measures for Personal Information Protection Compliance Audits in force 1 May 2025 require processors of more than 10 million individuals' information to audit at least every two years and the departments may order an audit by a professional institution (Article 64).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.