Passwords used with the product for its hardware when not in the factory default state, for software pre-installed when it is supplied to a consumer (again outside the factory default state), and for software that is not pre-installed but must be installed for all of the manufacturer's intended purposes that use the hardware or pre-installed or installable software, must be either unique per product or defined by the user (Schedule 1 clause 2(1), (2)). A unique-per-product password must not be based on incremental counters, must not be based on or derived from publicly available information, must not be based on or derived from unique product identifiers such as serial numbers unless through an encryption method or keyed hashing algorithm accepted as good industry practice (the skill and diligence expected of an experienced cryptographer), and must not otherwise be guessable in a way good industry practice would not accept (clause 2(3)). Cryptographic keys, pairing PINs for non-internet protocols and API keys are not passwords (clause 1). The standard follows the first three provisions of ETSI EN 303 645 and the UK PSTI regulations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.