The IED enforces authorization by assigning each user a level or role that determines the functions available, supporting role-based access control so that viewing, control, configuration change, firmware update and data retrieval can each be restricted to authorised roles; the 2013 alternatives of authorization levels by password (5.1.5.1) and RBAC (5.1.5.2) are brought together here.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.