The system is logically secured by authentication credentials the regulator allows (passwords, multi-factor, certificates, PINs, biometrics, cards): each user has an individual credential issued through a formal process; credential records are kept and changes forced; stored credentials are secure and any hard-coded credentials are encrypted; the fallback for failed authentication is no weaker than the main method; lost, compromised and terminated users' credentials are deactivated promptly; multiple access levels control viewing, changing and deleting critical files, with procedures to assign, review, modify and remove rights that provide separation of duties, limit who can adjust critical parameters and enforce credential length and expiry; suspect accounts with possibly stolen credentials are identified and flagged; every logical access attempt to applications or operating systems is logged securely; and utility programs that can override controls are restricted; passwords are recommended to change every 90 days, be at least 8 characters and mix two character classes.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.