Where keys move from the equipment that generated them to an electronic key-loading device, that device must meet these conditions. In particular: it is a physically secure SCD built so that any unauthorised disclosure of the key is either prevented or detected, and a PCI-approved KLD satisfies this; it is either overseen by someone management has authorised or kept in a secure container that unauthorised people cannot reach; only authorised staff acting under dual control can use it and enable it to send a key into another SCD, and they check that no recording device has been placed between the two SCDs; after use it keeps nothing that could reveal a key loaded into it or successfully passed on from it, for example through replay into a device that is not an SCD.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.