A certificate covers a uniquely identified and evaluated product version. A modified product released during the certificate's validity may be brought within its scope when: the modified product carries its own unique version number; a BSI NESAS audit report is valid and the modification was developed under the audited processes; the modifications amount to no more than minor changes in the evaluated version's functionality and architecture; and the modifications either keep up or restore the certified security performance (the aggregate of the security statements made in the evaluation) or have no effect on it. Inclusion does not change the certificate's validity period.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.