The framework defines authentication mechanisms and factors by resource criticality, applying MFA on a risk basis to remote access, privileged activities and access to sensitive or critical systems and datasets and, where appropriate, to sensitive customer, business or operational functions; failed attempts are limited against brute force and MFA bypass; concurrent access by one credential is allowed only for credible business need with each channel authenticated independently; external authentication solutions receive due diligence; and the suitability of mechanisms and factors is reviewed regularly with exceptions remediated and patterns investigated. Software and push-based OTP generators are robust in design, third-party OTP solutions are vetted, and SMS OTP onboarding verifies that the number belongs to the user and is not virtual, with MFA required to change it against SIM swapping. Biometric solutions are selected on key performance metrics and anti-spoofing with independent assessment where appropriate, held to stricter metrics for sensitive functions, monitored in deployment with remediation when metrics fall, protected by encryption of biometric data and templates in storage and transit with revocation and replacement of compromised templates, enrolled through verified procedures run by trained staff, and compliant with biometric data regulation. SSO policy servers are configured and kept current with authorisation policies, SSO token activity is logged, MFA applies to SSO access to sensitive systems and data, and third-party SSO solutions are vetted.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.