Earlier quoted context omitted.
At FB level, this is already a requirement for GDPR. The only difference is that it must be shared with an independent assessor rather than held strictly internally.
That seems like a pretty huge difference.
It's not that big. FB gets to choose the assessor.