Dual-control mechanisms prevent substitution or tampering of HSMs, deployed, spare and backup, throughout their life, with serial numbers verified against the sender's separately sent record, unnecessary HSM functions disabled and the configuration documented, sensitive functions blocked while online, and every HSM inspected and tested before installation; procedural controls may support but never replace the dual-control mechanisms.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.