Testing follows the plan approved at Stage One; analysts document every deviation with its justification and impact; testing is repeatable and reproducible with records that let an independent reviewer verify validity; and test data and environments are controlled, documented and retained for audit. Results are analysed against the declared level for each component and the whole system, covering classification accuracy and error rates including false positives, false negatives and outcome error parity, performance efficiency, resilience against the declared attack vectors, and the privacy, security and acceptability characteristics, and where testing was external or outsourced the analysis identifies the source and the weight given.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.