Documented procedures govern the destruction of unused or replaced components and shares so that nothing recoverable remains; paper components are cross-cut shredded, pulped or burned, and strip shredding is inadequate. In particular: keys held on any other medium and in any permitted form (physically secured, enciphered, other than electronic database backups of cryptograms, or as components) are destroyed using the ISO 9564 or ISO 11568 procedures; a third party who holds no component of the key witnesses its destruction and signs an affidavit that is retained for two years or more; once a key is loaded and confirmed working, its components are destroyed, except for HSM or KLD master file keys and except where the HSM keeps only subordinate keys internally with no encrypted values held in a database; BDK components may stay in a KLD when needed for reloading.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.