An entity that manufactures a relevant connectable product must provide, for the supply of the product in Australia, a statement of compliance with the security standard for its class where it is aware or could reasonably be expected to be aware that the product will be acquired in Australia in the specified circumstances, and must retain a copy for the period the rules set for that class of statement; the 2025 rules set five years (the exposure draft had proposed ten).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.