Where a component authenticates by password it must, itself or through integration with a system that does, enforce configurable password strength based on internationally recognised and proven password guidance (SL 1). RE 1 (SL 3): for human users, block reuse of a password across a configurable count of generations and enforce minimum and maximum password lifetimes in line with common industry practice, and it should be able to warn the user, a configurable time before expiry, that the password needs changing. RE 2 (SL 4): enforce minimum and maximum lifetimes for every user, human, software process or device.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.