Staff of the solution provider who can log on to deployed POI devices are formally listed, approved by management and reviewed every year or more often, and receive access on the basis of need to know and least privilege.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.