Every controller must designate a Data Protection Officer to ensure adherence to the Regulation, relevant privacy instruments and the controller's own data protection directives; the controller may outsource data protection to a verifiably competent firm or person. (The Implementation Framework, 3.4, made a dedicated DPO mandatory in four cases.)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.