Within an identity and access management framework covering credential management, authorisation and authentication, procedures manage credentials through their lifecycle with revocation and replacement of compromised ones and approval of every request by the resource owner and management. Solutions securely issue, modify and revoke credentials, store them encrypted in proportion to their rights, and protect credential stores with MFA and anti-malware; credentials are unique, unshared and granted to need. Passwords are complex and long, changed regularly without reuse, defaults changed at first login, and stored hashed or encrypted; password-less issuing authorities are protected with MFA and anti-malware and connecting systems configured for them. Third parties, contractors, part-time staff and external systems follow the same process, restrictions and monitoring as employees. All credentials are reviewed regularly, privileged ones more often, with dormant, redundant or wrongly provisioned credentials fixed in time and patterns investigated for root cause. Third-party or federated credential solutions receive due diligence on security characteristics before integration. Privileged credentials have strict approval, go to competent and trusted users and are not used for non-privileged work; all activity is logged with the credential tagged, logs are inaccessible to the credential that generated them and are reviewed regularly for unauthorised or malicious activity.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.