The vendor includes a QKD module Security Policy stating the security rules the module operates under (from the specification and any vendor additions), detailed enough to answer what access each operator in each role has to each security-relevant item for each service, which physical mechanisms protect the module and what operators must do to keep them effective, and which mechanisms mitigate attacks without testable requirements. It contains at least an identification and authentication policy (roles, authentication type and data, strength), an access control policy (roles, services, keys and CSPs, access types per service), a physical security policy (mechanisms and operator inspections or tests) and a policy for mitigation of other attacks; Annex A's documentation checklist for every area is supplied to the testing facility.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.