Where an impact assessment shows the processing would be risky unless the controller mitigates it, the controller must consult the supervisory authority before processing and may not start until the authority has pronounced on the report; the authority advises in writing within thirty working days, suspendable only while awaiting requested information.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.