The assessor should describe the programme, system or process being assessed: its purposes, the PII involved, the systems, devices and components, the parties with a role in the processing (controller, processors, suppliers), and its setting and boundaries. The standard's text at or just after this clause adds that the organization should, as an input to the PIA, lay out the flow of information in as much detail as it can so that privacy risks can be spotted, that the assessor should weigh effects both on privacy and on compliance with privacy-related law such as telecommunications legislation, and that the whole life cycle of the PII should be covered. The Bavarian DPA's mapping ties this clause to fixing the scope of the assessment (system architecture and data flows in its worked example); the description feeds 7.3.1 of the report.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.