An entity that supplies a relevant connectable product in Australia must supply it with a statement of compliance with the security standard for its class where it is aware or could reasonably be expected to be aware that the product will be acquired in Australia in the specified circumstances, and must retain a copy for the period the rules set (five years under the 2025 rules).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.