The GOOSE and SV PDUs are extended with security octets: a reserved field carries the security indication and key identifier, a message authentication code (HMAC or AES-GMAC) is calculated over the defined domain of the packet, and where confidentiality is applied AES-GCM authenticated encryption covers the payload, the publisher signing every message and the subscriber verifying before use.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.