The IED provides no back door, master password, hidden command or other mechanism by which the authentication controls can be bypassed, and the manufacturer declares that none exists; any recovery from lost credentials is performed through a controlled, auditable procedure rather than a defeat mechanism (2013's 5.1.2, now here).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.