The body is responsible for managing all information obtained or created during certification, and that responsibility must rest on legally enforceable commitments. Information the client has made public, or information released with the client's agreement, falls outside the confidential category. Everything else is proprietary and must be treated as confidential. Before information goes into the public domain, the client has to be told what will be published. Where a statute or a contract obliges the body to disclose private material, it must tell the client or the person affected, unless the law forbids that. Information about a client that comes from someone else, such as a complainant or a regulator, is also confidential.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.