The practice statement sets out the configuration management approach in line with ISO 10007: how configuration items are identified and controlled, how changes are assessed, approved and put into effect, how status is recorded and reported, and how configuration audits run. It states whether configuration settings are applied only by the provider or can be set or altered by relying parties, for instance through a dashboard, and where relying parties can do so it describes the safeguards against configurations that would breach ISO/IEC 27566-1, how security, privacy and acceptability are preserved under permitted settings, and the controls that stop efficacy being reduced (lowering thresholds, disabling liveness checks, bypassing privacy features). The conformity assessment body judges whether the approach maintains conformity through the cycle, including version upgrades and relying party choices; any option capable of lowering the indicators of effectiveness, or of stripping out an essential privacy or security control, is prohibited or technically constrained.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.