Intermediate control principles for access control (required, with baseline, of an AI whose inherent risk is medium). Changes to user access permissions trigger automated notices to the right personnel, on a risk basis; database administrators are prevented from downloading or transmitting confidential data without authorisation; multifactor authentication protects staff access to the high-risk systems the risk assessment identifies; strong authentication secures all third-party access to the institution's networks, systems and applications. In 2.0 privileged remote access carries a documented rationale reviewed regularly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.