Installed customer equipment must hold only credentials unique to the device and not guessable from its metadata; remain supported by its supplier, with customers told before and when support ends and offered a replacement while the service is provided; have management interfaces reachable only from specific management address ranges over a current secure protocol; expose customer-facing management only inside the customer network by default; and block unsolicited incoming connections by default. Due: Tier 1 and Tier 2 by 31 March 2025.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.