The control system shall identify and authenticate all software processes and devices, enforcing it on all interfaces that provide access to the system, so that a process or device cannot act without being known. RE 1 requires unique identification and authentication of each process and device; the held ISAGCA paper describes this as the SL 2 capability that closes off unauthenticated rogue devices and processes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.