Where authentication is public key based, the component must, directly or through an integrated system in the same IACS environment, be able to (SL 2): validate the signature of a given certificate; validate the certificate chain, or for self-signed certificates deploy leaf certificates to every host that communicates with the certificate's subject; check the certificate's revocation status; establish that the user (a human, a software process or a device) holds the corresponding private key; link the identity that was authenticated to a user; and meet a sixth item concerning the keys and algorithms the authentication relies on. RE 1 (SL 3): protect critical, long-lived private keys through hardware mechanisms.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.