The conformity assessment body assesses the practice statement against the five core characteristics of ISO/IEC 27566-1 (functionality; performance; privacy; security; acceptability), determining whether its claims are supported by testing, analysis and audit evidence, consistent with the declared boundaries and contexts of use, and in line with the normative references and the scheme's requirements. The client reviews and updates the statement at least annually and whenever a major change occurs or a change materially affects any core characteristic, submitting updates for review. The optional ACCS Practice Statement Tool may be used, but every statement follows the standardised Clause 10 structure. Auditors review the statement for completeness and consistency at Stage One, verify at Stage Two that evidence substantiates its claims, and raise gaps, inconsistencies or unsupported claims as nonconformities.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.