The certification body sets a formal validity period for a certificate, while what it says technically about reliability and security holds as at the issue date, since future attack resistance is hard to predict; minor updates neither extend nor change the validity period. A NESAS audit stays valid two years from the date its final audit report was issued, for the FS.16 security requirements version it covers, and an audit must not be older than two years when an evaluation starts; a new audit is required for evaluations that rely on processes the vendor has significantly changed, or where a security breach at the vendor affects the audited processes. An IT security certificate's formal validity generally runs for two years, with deviations possible for particular product classes under specific legal conditions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.