The IED requires each user, whether accessing locally or remotely, to be identified and authenticated before any protected function is available, with individual credentials managed on the device or through a supported central mechanism; configuration software access to the IED is subject to the same identification and password control (Table 1: 2013's 5.5.3 and 5.5.4 now in 5.1).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.