Where an AUM-1 mechanism on a network, user or machine interface uses factory default passwords, each is unique to the unit and either meets best-practice strength or is forced to change at or before first use. Where other passwords are used, one of three patterns applies: the user is made to set the password at or before first use and before the unit is logically joined to a network; an authorised entity defines it within a network that only authorised entities can reach; or the unit generates it to best-practice strength and discloses it only to an authorised entity within such a network. The standard notes that a user may choose to use no password at all; that case is outside the Official Journal citation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.