The plan must require consistent criteria for the security boundaries that scope nonlocal access controls, management of every nonlocal access method and of access approvals, handling of consecutive authentication failures per the risk strategy, manual and automatic session management (enablement, termination, duration, inactivity timeout, re-authentication), defined nonlocal access for emergencies (outages, cyber and physical incident response) and an access log retention schedule. At the Enhanced Profile nonlocal communications crossing an external conduit are encrypted, third-party nonlocal access is approved by both the security and operations functions, and the actions, functions or transactions each session may perform are defined; at the Extended Profile technical controls prevent unauthorised actions, functions and transactions in nonlocal sessions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.