The CBS shall allow initialising authenticators, changing every default authenticator at installation, changing or refreshing all authenticators, and protecting them from disclosure or modification in storage and transmission. (from SR 1.5 of IEC 62443-3-3)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.