The system enforces a certification practice statement and certificate security policy that are explicit and clearly defined. In particular: a CA issuing certificates to KDHs and to other CAs operates offline on its own closed network used solely for issuance and revocation, reachable from outside only through a separate DMZ platform that publishes certificate status to relying parties; for an online CA such as one that signs POIs, updates to CA or RA software are made at the local console and never across the network; for an online CA, any access other than at the console, remote console access included, requires multifactor authentication; for an online CA, users reaching the CA or RA environment from anywhere but the console do so through authenticated, encrypted sessions, and no other remote route exists for administering the system or application; access purely for monitoring is not restricted; the CA keys that sign certificates for POI and KDH authentication and status checking can be enabled only under dual control or stronger, although a single user with logical access to the RA application may vet certificate requests.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.