Mechanisms deal with CA compromise arising from key compromise or poor key handling, including procedures to notify affected entities and to revoke or otherwise invalidate subordinate certificates, across the four sub-requirements. In particular: on a known or suspected compromise, the CA halts certificate issuance and carries out a damage assessment that documents the cause and the way it came about; when compromise is confirmed, the CA decides whether every certificate it signed should be revoked and reissued under a newly generated signing key; controls such as time stamping stop fraudulent certificates from being used once found; the compromised CA informs the CAs above and below it, and the damage analysis determines whether subordinate CAs and KDHs should receive reissued certificates or be told to apply for new ones.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.