Where public key authentication is used, the control system must be able to validate a certificate's signature, validate its path to an accepted certification authority (or, for self-signed certificates, deploy leaf certificates to every host that talks to the subject), check its revocation status, establish that the user (human, process or device) controls the matching private key, and link the identity that was authenticated to a user. RE 1 requires hardware protection of the private keys.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.