In the evaluation phase the facility reviews whether the audited development processes were applied to the product, using the audit report and the evidence it calls for, which the vendor must hand to the facility, and carries out standardised security tests on the actual product according to the SCAS documents named in the application or that AIS-N2 mandates (FS.13 chapter 5.8). Which SCAS documents apply depends on the functionality the product offers, and the applicant must name them in the application, with assignment made through AIS-N2; the facility records and summarises the SCAS test results in an evaluation technical report, the ETR. The evaluation can start only with a valid audit (5.4.2.1) and its audit report, and the applicant and manufacturer must do nothing that might compromise the impartiality of the facility or of its evaluators.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.