Objective (held): fix the PIA's scope and the expertise it needs and draw up its terms of reference. The rest of the clause is not held; the held term 3.3 makes the assessor the person leading and doing the PIA, backed by internal or external experts, and the Bavarian DPA's 2017 mapping ties this clause to assembling the DPIA team (its worked example names a sponsor, a process owner leading the project, the data protection officer, IT and legal sub-leads and the cloud supplier's contact). Management gives the team its mandate, resources and reporting line.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.