Equipment that processes financial data verifies, by cryptographic means, the integrity and authenticity of its software supplied by the manufacturer or its subcontractor during the boot process, for every part of the software that processes financial or security assets, anchored in a root of trust that is either immutable or changeable only under cryptographically authenticated authorisation. (GEC-7 is intentionally left blank in this Part.)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.