The body must require everyone who takes part in certification to sign an agreement or a similar instrument that commits them to three things. They must follow the body's rules, including confidentiality and freedom from commercial and other pressures. They must declare any past or present association, their own or their employer's, with a supplier or designer of products, a service provider or developer, or a process operator or developer to which they are assigned for evaluation or certification. They must reveal any situation they know of that could present them or the body with a conflict of interest. The body must use those declarations when it identifies risks to impartiality from the person's activities or from the organisations that employ them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.