The head of an institution designates a data protection officer; every person, institution or public body whose activities involve regular and systematic large-scale monitoring or whose core activities involve special personal data must designate one, trained, who audits compliance, is the contact with the Office, keeps records of processing activities, informs data subjects and ensures their access and erasure requests are handled (large scale judged on numbers of subjects, volume, duration and geographic extent).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.