Each HSM holds a current, unexpired FIPS 140-2 or 140-3 certification at Level 3 or above, or a PCI approval (a FIPS certificate shown as historical or revoked is not acceptable), and a PCI-approved HSM whose approval limits it to controlled or secure environments under ISO 13491-2 and its security policy is deployed only in such an environment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.