No later than the start of the evaluation the applicant or vendor shall provide the facility with: the full NESAS process audit report with all attachments; a compliance declaration with all compliance evidence for the network product; the network product itself with peripherals and a unique version number; product documentation including the parts list, the supporting operational environment and a network plan; supplementary information and developer resources the evaluation needs, such as licence information, login accounts and contacts for certification and technical support; and a list of the TR 33.926 chapter 5.3 threats the product leaves unmitigated or only partly mitigated, together with the operational environment requirements needed for secure operation. The vendor also gives the certification body the audit report and the conformity evidence it requires (unless the body already has them from a previous audit), which forwards them to the facility.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.