A registered provider must keep providing its services in accordance with the DVS trust framework (and any supplementary code recorded in a note), whose rules can govern the provider and its conduct and which the Secretary of State reviews at least every 12 months and may revise. Registration of a person or a service is removed when the provider asks, stops providing the services, or no longer holds a valid certificate for them; a supplementary note is removed in the same cases and when the code is withdrawn (on at least 21 days' published notice). The Secretary of State may remove a provider that is failing to comply with the framework or a code, has not answered an information notice, or on national security grounds, after written notice of the reasons and at least 21 days for representations, and may bar re-registration for up to two years.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.