Procedures protect SCDs that are retired or sent back for repair from interception or misuse, and make every key, piece of key material and item of account data in them unrecoverable before they leave: HSM decommissioning is done under dual control, keys that cannot be shown to be erased are removed by zeroisation or physical destruction under dual control, testing and inspection confirm the result, affected entities are told before a device is returned, returned devices are tracked in transit, and records are held for a year or more.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.