Where secret keys are distributed remotely using public-key protocols, the Domain's remote key-distribution requirements apply: key lengths as Annex C sets out, key generation under current ANSI and ISO standards, and mutual authentication between host and POI (or between two hosts) that assures the host that the device holds, or can derive, the session key and that nobody else is able to.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.