To apply for a maintenance procedure under Clause 4 the vendor prepares an Impact Analysis Report carrying a unique version number and date and structured as introduction, description of changes, reuse of evaluation results, and annexes. The introduction identifies the product name and version and how the version can be verified in operation; states the basis for maintenance, namely the certification number of the valid certificate (or of the ongoing procedure where a modified version is introduced mid-evaluation), the valid BSI NESAS audit report's identifier (BSI-AUD-NESAS, then a four-digit number and the year) and the previous product version the changes were made to; and may add information such as the document's confidentiality. The description of changes covers: changes to the development and lifecycle processes within the referenced audit's scope and to the threat model underlying the product's security architecture; newly added or disabled interfaces, changed functionality of existing interfaces, changed security-relevant configuration parameters such as defaults or new parameters, and internal and third-party components (libraries, container images) that were added, removed or swapped, with no need to list updates of components present before; and a list of all defect corrections, whether or not they affect security functionality.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.