The IED's main security functions are each placed under the authorization mechanism so that each can be restricted by level or role. The 2013 edition, which Table 1 says is now 5.2.3, lists seven: (a) viewing data; (b) viewing configuration settings; (c) forcing values; (d) changing the configuration; (e) changing firmware; (f) managing IDs and passwords or RBAC; (g) the audit trail. A conformance declaration answers each item separately.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.