Administrator passwords are changed periodically, at least once a year; whenever an employee or third party who knew them leaves; and after any network and information security breach. Every operation, process and activity performed with administrative rights on systems and components is documented for each administrator profile in the compliance records required by Article 5(3) and (4) and in the system logs governed by Article 29 items 2, 4, 5 and 6 (timestamping, restricted read-only access, twelve-month retention, correlation). That documentation must not contain administrator passwords in plain text or in hashed form.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.