Multi-factor authentication is implemented for any individual accessing any information system, unless the Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.