Where source code or other highly sensitive information is classified under the vendor's documented security policy and may not leave the development environment, the audit team, the evaluators and the certifier may assess and analyse it on the applicant's premises, in the development environment for example, provided the applicant convinces the certification body that disclosure would conflict with its essential interests; the extra time and cost this causes for all parties are borne by the applicant. Documents between applicant, facility and certification body are generally exchanged by encrypted email using OpenPGP in line with BSI TR-02102-1, with keys exchanged before the audit and evaluation kick-off meetings; applications use the public key published for the NESAS mailbox, electronic documents go to that mailbox (copies may go to certifiers), and the general procedure description governs paper, courier and physical media deliveries.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.