A secret or private key exists only in one of these forms: at least two separate full-length components or shares; encrypted under a key that is equally strong or stronger as Annex C sets out; or inside an SCD. A key-injection facility may hold clear-text material outside an SCD only within a secure room that satisfies Requirement 32, and a hybrid decryption Host System may keep clear-text data decryption keys briefly in volatile memory to decrypt account data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.