HSMs and other SCDs that generate or load keys for POI devices, or that sign applications or whitelists loaded into POI devices, are protected against unauthorised access and use by documented procedures: dual control by at least two authorised people to authorise use, passwords or authentication codes of at least five characters, dual control for manual or non-routine key-encryption functions, for placing the device in a clear-text component state and for all KLD access, no default passwords, and the devices always within a secure room either locked or sealed or under continuous supervision by two authorised people.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.