A product certificate covers one specific product version together with its minor updates, provided every condition the certification report sets on how the product is generated, configured and used is observed. The certificate attests the product's reliability and security against the audit and evaluation specifications underlying it, as at the issue date. What users must do comes from the certification report; the conditions and other ancillary provisions binding the certificate holder come from the certification notice; and anyone using a certified product must feed the results, the parameters and the requirements that accompany the certificate into their own risk management.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.