Discloses how physical locks stop unauthorised people with physical access from compromising PII on the device or its removable media: whether the device is software-only, in which case the rest is N/A (PLOK-1); whether every component holding PII other than removable media is physically secure, meaning it cannot be removed without tools, a key counting as a tool (PLOK-2); whether those components are secured behind a lock with its own key (PLOK-3); and whether the customer can fit a physical lock restricting access to removable media (PLOK-4).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.