Every authentication mechanism required by AUM-1 checks the entity's claim against evidence from at least one of knowledge, possession and inherence. Where the equipment's main purpose is to process special categories of personal information, access to that information through a user interface carried over a network interface is supported by two-factor authentication, meaning evidence from two different ones of those three categories.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.