Before issuing a certificate for a public key whose request did not originate in the same Level 3 secure room, documented procedures confirm the identities of both requestor and recipient. For KDH requests at least two checks are used from a set that includes proof that the requester holds the private key (a signed PKCS #10 request or an equivalent), confirmation that the organisation exists and has authorised the requestor, and the other checks the requirement lists.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.