A network device must provide protection from malicious code, with the supplier documenting the means. No enhancement: the IIC list names RE 1 (report the protection version) only for the host device. The identifier is named in the IIC SMM mapping list. See the official text for the full requirement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.