Changes to the ISMS may be managed and notified to the competent authority under a procedure the organisation develops, approved by the authority except for declared organisations; for changes outside that procedure the organisation must apply for and obtain the authority's approval (not required for declared organisations, which may implement immediately), applying before the change so the authority can determine continued compliance and amend the certificate and terms of approval if necessary, supplying any information requested, implementing only on formal approval, and operating under the conditions the authority prescribes during implementation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.