CSPs are protected inside the module against disclosure, modification and substitution and PSPs against modification and substitution; CSPs encrypted with non-approved functions count as plaintext; all SSPs are documented. The module contains random bit generators or entropy sources, each listed; those used in approved mode are approved, entropy sources pass the entropy source test, deterministic parts pass the algorithm test, output passes the continuous test, externally supplied entropy is checked against the claimed minimum, and random IVs come from an approved generator. SSPs used by approved functions are generated by approved methods with generator strength at least that of the function, and SSP establishment in approved mode uses approved or allowed methods with approved random inputs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.