On a civil investigative demand relevant to an investigation, a controller must make its data protection impact assessments available to the attorney general, who may evaluate them for compliance with chapter 4; the assessments stay confidential and disclosure does not waive privilege or work product protection.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.