Define and document the allowed and prohibited account types, assign account managers, set conditions for group and role membership, and specify authorized users, memberships and the access authorizations and attributes for each account (the Policy lists the federation attributes such as employer ORI, NCIC certification indicator, sworn officer indicator and the assurance levels); require approval of account requests, manage accounts under agency policy, monitor their use, notify account managers and administrators within one day when accounts are no longer needed, when users leave or transfer, and when usage or need to know changes; authorize access on a valid authorization, intended use and the listed attributes; review accounts at least annually; change shared or group authenticators when members leave; and align account processes with personnel termination and transfer.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.