Processes handle reports of suspicious activity that merchants, component providers or other third parties send in (physical breaches; devices tampered with, missing or substituted; unauthorised logical changes; failed device security controls; unauthorised use of sensitive functions such as key loading; failed encryption or decryption) and notify each affected party straight away.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.