Subject to all the requirements of subdivision (a), a connected device equipped with a means of authentication outside a local area network is deemed to have a reasonable security feature if either (1) the preprogrammed password is unique to each device manufactured, or (2) the device has a security feature that requires the user to generate a new means of authentication before access is granted to the device for the first time. Authentication means a method of verifying the authority of a user, process or device to access resources in an information system. The subdivision does not displace (a): a device that meets (b) must still carry features appropriate to its function and data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.