Mechanisms detect suspicious activity and respond to it, including: physical breaches; devices that are tampered with, missing or substituted; unauthorised logical changes; unauthorised use of sensitive functions; devices being disconnected or reconnected; a device security control that fails; failed encryption or decryption; and any unauthorised call on the HSM API.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.