The vendor must hand over its documentation of the processes and measures at its site that are meant to secure compliance with the security requirements in GSMA FS.16 (AIS-N1 chapter 2.2), directly to the lead auditor by the time the audit phase begins at the latest. Documents travel through the data exchange platform the certification body specifies, with each file end-to-end encrypted with OpenPGP for each recipient and the certification body included as a recipient under the valid process key; later document requests to answer questions follow the same route.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.