Where the application implements whitelisting, its Implementation Guide tells the installer how to configure it, how to sign it and how the device authenticates it, that it must be reviewed to confirm it outputs clear-text data only for non-PCI payment brand cards, that authorised personnel must approve it, and that every new installation or update must follow those steps.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.