From the BSI's published list of recognised evaluation facilities, the applicant engages one suited to the programme to evaluate its product and signs an evaluation contract covering the network product (see 5.3.2 on the contract). The BSI holds agreements or administrative provisions with the recognised facilities, whose own rules keep information confidential; the facility's authorisations cover specific techniques, product groups and evaluation aspects, and in each evaluation it must see that every evaluation activity is performed properly, with technical soundness, correctly and completely according to the applicable test methods and the certification body's specifications.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.