Where the pre-operational tasks happen once the device has been delivered, rather than with full trust provisioning by the manufacturer, the package adds the threat of compromised initialisation of TSF data, objectives for access control to personalisation and proof of intactness after delivery, an environment objective of secure initialisation, and the corresponding SFRs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.