The control system shall keep sessions intact, rejecting invalid session IDs. RE 1 requires invalidating session IDs at logout or termination, RE 2 unique session IDs, RE 3 randomness of session IDs. The ISAGCA paper describes the base requirement as an SL 2 addition.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.