From what I understand, the assessment concerns the program and the way personal information is handled. The tool that will be used to do the same work may change, so it's not necessarily the tool that has to undergo an assessment. The recommendation is to proceed with the assessment for an activity or program. In our case, we chose to conduct the higher-level assessment for the computer forensic program.
On February 13th, 2024. See this statement in context.