A production HSM and its server may be used for testing on a temporary basis only where a business rationale exists and only once every item of keying material has been removed. After testing, every test key is deleted, the platform is wiped and rebuilt using read-only media, and the production keys are restored under dual control and split knowledge, with physical and logical security maintained the whole time.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.