The IED enforces construction rules for memorized secrets (length and character composition appropriate to strong passwords) and does not display a password in clear text while it is entered or stored; the 2013 requirements on password construction (5.1.4) and password display (5.1.7) are combined here.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.