The framework defines the authorisation model, the users, processes, services and systems in scope and the administrative procedures by which policies are created, changed, enforced, retired and removed; solutions align with the model and policies grant the least access needed, support segregation of duties and apply the never-alone principle to privileged activities so no single user acts unilaterally; certificate authorities used for authorisation are configured to the model with relying systems recognising certificates for the specified duration; no person, including senior management or Governing Body members, has unfettered access to data or the network; and access policies and their credentials are reviewed regularly with expired, redundant, excessive or wrongly assigned access corrected and patterns investigated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.