Where the device uses passwords to authenticate users or for machine-to-machine authentication, every password in any state other than factory default is either unique to that individual device or chosen by the user. Universal defaults such as the same admin credentials across a product line are prohibited; unique pre-installed passwords, a user-chosen password at initialization, or a non-password method all satisfy it. Standard pairing codes are not treated as machine-to-machine passwords. Status in Table B.1: M F (a) (mandatory, a shall provision; applies only where passwords can authenticate users to the device or machines to each other).
This control maps to 3 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.