The evaluation tests the network product technically and reviews whether the audited development and lifecycle processes were applied to it, assessing protection of the assets the 3GPP specifications define for the evaluated network functions against the threats in 3GPP TR 33.926. A valid audit covering all the processes used to develop the product is a prerequisite (5.4.2.1), and the product must be clearly assigned to those audited processes; the facility also checks that the vendor's evidence meets the evaluation requirements set in the audit report (GSMA FS.47 chapter 4.1). The product must belong to a 3GPP product class for which security assurance specifications (SCAS) exist and are listed in AIS-N2; if it cannot be assigned to a listed class no BSI NESAS evaluation is possible. The scheme is for products ready to be commercialised: an evaluation does not run alongside development, though defects can still be corrected during the procedure.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.