On the Attorney General's requirement in an investigation, a controller must make relevant data protection or impact assessments available; the Attorney General may evaluate them for compliance; they are confidential and exempt from the Public Records Act, and disclosure does not waive privilege or work product protection.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.