The application is developed to industry best practice and the device vendor's security guidance with information security throughout the lifecycle: live PANs are never used for testing or development, and development, test and custom accounts, IDs and passwords are removed before release.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.