Where an account is reached remotely to wager or to manage it, the player must re-authenticate after 30 minutes of inactivity on the device, or a regulator-set period, with no further wagering or financial transactions until then; a simpler re-authentication such as operating-system biometrics or a PIN may be offered, evaluated case by case by the laboratory, may be disabled by player or regulator preference, and full authentication is required on the device at least every 30 days or a regulator-set period.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.