Microcode delivered, configuration-controlled and qualified with the device by its manufacturer counts as part of the qualified device. Where microcode is not so qualified or is modified by the applicant, a means of compliance commensurate with the device's usage is proposed by the appropriate process (hardware, software or system), and the planning documents record its existence and where it is addressed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.