BSI NESAS Product Certification Scheme (NESAS-Produkte)...

What does 3.3.5b require?

The vendor archives every item of evidence that bears on the evaluation, and the evaluated product itself, for as long as the certificate is valid plus a further three years; the evaluation facility likewise archives the evaluation evidence and the certification body the evidence relevant to the certification.

Other controls in Clause 3.3: Certification process (preparation, audit, evaluation, certification) – BSI NESAS Product Certification Scheme (NESAS-Produkte)

3.3.2.1 Preparation phase tasks of the vendor
3.3.2.3 Application form, language and third-party declarations
3.3.3.1 Audit phase: scope, site, preparation and impartiality
3.3.3.2 Process documentation submitted to the lead auditor over the encrypted exchange platform
3.3.3.3a Cooperation during the audit: encryption, schedule, clarifications and resources
3.3.3.3b Audit result, re-audit within three months and the audit report
3.3.4.1 Evaluation phase: SCAS selection, valid audit and impartiality
3.3.4.2a Document mitigation of every TR 33.926 threat

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All BSI NESAS Product Certification Scheme (NESAS-Produkte) controls