A DSP seeks advice from the Digital Partnership Office before using enterprise single sign-on for its clients, and where SSO is implemented ensures that: disabling MFA is controlled by the DSP, not the client; encryption in transit between the client's system and the software uses an approved protocol; remember-me is limited to 24 hours; SSO tokens last at most 24 hours; tokens or temporary credentials are isolated to one device and expire once used or within 24 hours; brute force lockout applies after at most five failed attempts; credentials are stored separately from the system granting access; confirmation passwords are hashed, salted and stretched; inactive sessions time out after at most 30 minutes (15 preferred). The DSP advises the DPO that SSO is implemented and meets these standards.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.