For CBSs without type approval, survey and FAT at the supplier's or other suitable works show by test or analysis that the CBS complies, leading to a System certificate that accompanies it. The supplier shows design, construction and internal testing are complete and the delivered system matches the approved inventory and topology; tests the security capabilities to the approved procedure, witnessed or accepted by the surveyor (identical components need not all be tested); shows settings match the configuration guidelines, recorded in a report; and demonstrates the SDLC requirements with management system evidence for each of 5.1 to 5.7.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.