CSO-approved compensating controls for advanced authentication on agency-issued smartphones and tablets with limited-feature operating systems are permitted as temporary measures where a legitimate technical or business constraint prevents compliance, only after MDM is implemented; they must meet the intent of the requirement, give similar protection, not rely on the existing AA requirements, expire on the approved date or when compliant AA arrives, and include at least possession and registration of the agency-issued device, device certificates per 5.20.7.3 and Policy-compliant authenticator protection on the secure location where CJI is stored.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.