Sensitive security parameters held in the device's persistent storage are stored securely: critical ones (secret keys, passwords, private certificate parts) protected against both disclosure and modification, public ones (such as the update verification key) against modification. Suitable means include a trusted execution environment, hardware-bound encrypted storage, secure elements or UICC. Status in Table B.1: M F (k) (mandatory, a shall provision; applies only where sensitive security parameters are held in persistent storage).
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.