A GDPR certification body is accredited by the national accreditation body under conformity assessment law, and only after the Inspectorate has given an opinion that it meets Article 43(2) GDPR and the Inspectorate's own published criteria; the accreditation body reports accreditation, suspension, withdrawal and changes to the Inspectorate within five working days, and the Inspectorate may itself certify while no body is accredited. A body monitoring a code of conduct under Article 41(1) GDPR needs a five-year licence from the Inspectorate, on Cabinet requirements and on payment of a State fee, and must notify the Inspectorate of changes to its name, registration number or contact details within five working days after they take effect.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.