User authorisation is enforced by a secure, controlled mechanism that can verify on demand and regularly that a component is operated by an authorised user; automated equipment identification used to verify connections coming from particular sites and equipment is documented and included in access rights reviews; authorisation information used for identification is obtained from the system at the time of the request and not stored on the component; and administrators are notified and users locked out or an audit entry made after a set number of failed attempts.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.