Before the certification audit the certification body asks the client to say whether any AIMS information cannot be shown to the audit team because it is confidential or sensitive, for example AIMS records on how controls are designed and how well they work, or access to source code and raw data, and decides whether the AIMS can still be audited adequately without it; where it cannot, the client is told that the audit cannot go ahead until access is granted. Certification bodies applying the clause settle in advance with the client the contractual, operational and technical arrangements for that access, including safeguards for protected and sensitive information, intellectual property, trade secrets and the technical tools to be used, and may decline the application if the confidentiality conditions cannot be met.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.