Where recertification under 4.2 is requested, the IAR's reuse section may identify the SCAS tests for which the vendor asks to reuse results from a previous evaluation; otherwise it may be left blank. The annexes must clearly reference the vendor evidence for the version under certification: the threat model, the security test plan and its report, the release notes, the software bill of materials, product documentation such as the technical description and configuration and hardening guidance where it changed, and, where new third-party components were added, evidence that the audited third-party component process was followed. Every section must be specific enough that the certification body, and the facility where applicable, can use it for technical assessment and planning.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.