Manage authenticators by verifying the recipient's identity at initial distribution, setting initial content, ensuring sufficient strength of mechanism, running procedures for distribution, loss, compromise, damage and revocation, changing default authenticators before first use, changing memorized secrets annually or on evidence of compromise and other authenticators on expiry or compromise, protecting authenticator content, requiring users and devices to protect authenticators, and changing group or role authenticators when membership changes; and, for credential service providers at Authenticator Assurance Level 2, meet the Policy's embedded NIST SP 800-63B criteria on multi-factor authentication with approved cryptography and replay resistance, authenticated protected channels, FIPS 140 validated verifiers and authenticators, device unlock not counting as a factor, reauthentication at least every 12 hours and after 30 minutes of inactivity, privacy requirements, biometric performance and rate limiting, authenticator binding, and session management with non-persistent session secrets of at least 64 bits of entropy over secure transport.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.