Any whitelisting functionality that lets clear-text data leave the device is implemented so that it can output clear-text account data only for non-PCI payment brand cards, is cryptographically signed before installation and authenticated by the POI device, is reviewed to confirm it does only that, is approved by authorised personnel, and has every new installation or update signed, authenticated and put through change control with a description, justification, approver and pre-release review.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.