The audit looks at the development and lifecycle processes behind a network product, or behind a product class sharing identical processes. A vendor that produces and sells products must define and implement measures that make these processes conform to the relevant security requirements. The lifecycle runs from product development and first commercial release through minor and major updates that fix vulnerabilities or change functionality, to the product's end of life, and the initial development process runs from planning and design through implementation and testing to release, manufacturing and delivery (GSMA FS.13 chapter 5.2). The audit team analyses the vendor's processes, judges whether the measures implementing the vendor-defined security requirements are appropriate and effective, and then checks on site that they are applied in practice; the audit also defines the criteria and the evidence by which application of the audited processes to the certified product will be evaluated (FS.13 chapter 5.7). A valid audit can underpin the evaluation of several network products developed under the audited processes within the audit's validity period.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.