The applicant is bound to take part in the certification process as the BSI certification ordinance (BSIZertV) requires. Until the certificate is issued this includes telling the certification body and also the evaluation facility about vulnerabilities known in the product while the procedure runs, and about vulnerabilities and incidents known at sites that cause the audited processes to fall into non-conformity. The duties that follow issue of the certificate are laid down in the certification notice and in the certification report.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.