Each special class unmanned aircraft certificated under 14 CFR 21.17(b) must have its equipment, systems and networks, considered both individually and in their relation to other systems, protected from intentional unauthorized electronic interactions that could adversely affect the security or airworthiness of the aircraft. The applicant demonstrates this protection by showing that the security risks were identified, assessed and mitigated as necessary. Where that protection applies, the procedures and instructions that keep the security protections in place must be part of the instructions for continued airworthiness. The FAA's reasoning: the command and control link on which a remote pilot depends makes the aircraft uniquely exposed, and the general systems rules (23.2510, 25.1309, 27.1309, 29.1309) do not address security; associated elements such as the control station and link are brought in through D&R.105, which lists cyber security among the requirements their interface specification must cover. The FAA declined, in the Wing final criteria, to prescribe specific C2 link tests, holding that the general criterion already covers them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.