The base PP defines the TOE's assets and TSF data together with its users, objects, subjects and security attributes and counters six threats (unauthorised access to TOE data and functions, session hijacking or piggybacking, eavesdropping on QKD link data, manipulation of QKD link data, exploitation of TOE malfunction, observation of TSF characteristics) under three organisational security policies (the TOE provides key distribution services, security operations are audited, a secure end-of-life state is reached) and two assumptions (the TOE is maintained diligently and operated inside a secure area); the life cycle runs through calibration, QKD, failure and end-of-life states.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.