The body may outsource evaluation only to organisations that satisfy the relevant standards where they apply and any scheme documents. Testing must meet ISO/IEC 17025, inspection ISO/IEC 17020 and management system auditing ISO/IEC 17021, and the impartiality rules for evaluation personnel always apply. Where the work goes to a non-independent body, such as a client laboratory, the body must manage it so that the results can be trusted and keep records that justify that confidence. There must be a legally binding contract with the provider, including confidentiality and conflict of interest provisions. The body remains responsible for all outsourced activity; must ensure the provider and its people are not involved in a way that could undermine the credibility of the result; It must keep written rules, processes and records for qualifying, assessing and monitoring providers; must keep a list of approved providers; must take corrective action for breaches; and must tell the client in advance so that the client can object. Hiring an individual on a contract is not outsourcing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.