The control system must be able to identify and authenticate every human user, and enforce that on every interface that gives a person access to it, so that segregation of duties and least privilege can be supported under the applicable policies. RE 1 requires each human user to be identified and authenticated uniquely; RE 2 multifactor authentication for human access over untrusted networks; RE 3 multifactor for all networks. The enhancements are how the four security levels are distinguished for this requirement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.