Private keys held in hardware cryptographic modules should not remain valid for more than 5 years at MODERATE or 3 years at ADVANCED (without limiting CA certificate lifetimes); private keys held in software cryptographic modules must not be valid for longer than 2 years at MODERATE and software modules are not accepted at ADVANCED.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.