A provider of digital verification services (services provided over the internet, at an individual's request, that ascertain or verify a fact about the individual from information not supplied by the individual and confirm it to another person) is registered on the Secretary of State's public DVS register only if it holds a certificate from a conformity assessment body accredited by the UK national accreditation body that the services are provided in accordance with the DVS trust framework, applies for the services covered by the certificate in the form and with the information and documents the Secretary of State's published determination requires, and pays any fee set by regulations. Additional services, and supplementary notes recording conformity with a supplementary code, need the same certificate, application and fee. An expired or withdrawn certificate, or one the framework or code says must be ignored after a revision, does not count. The Secretary of State may refuse registration for national security or where satisfied the provider is failing to comply with the framework, after written notice and at least 21 days for representations, and may bar a further application for up to two years.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.