Entities under Article 16(1) must document, implement, enforce, monitor and periodically review logical and physical access procedures that grant access on need-to-know, need-to-use and least privilege including remote and emergency access; keep users identifiable for their actions; manage user, generic and administrator accounts, assigning privileged, emergency and administrator access on a need-to-use or ad hoc basis and logging it; use authentication proportionate to classification and risk, with strong authentication for remote network access, privileged access and publicly available assets supporting critical or important functions; and review rights periodically and withdraw them when no longer needed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.