The evidence package shall include a software bill of materials in the form AIS-N2 Annex A defines, covering every library and package present in the deployed network product; where a vendor-maintained library or package is based on software under an OSI-listed licence, an SBOM entry for that underlying software is also required, with the purpose field referring to the library actually included. It shall also include, per included library or package version, a vulnerability analysis listing the CVEs concerned together with proof that patches were applied or an assessment of what mitigates exploitation of each vulnerability.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.