Control: provide adequate controls for users to identify and authenticate the telecommunications organization. Purpose: to ensure users connect to the correct provider and to prevent unauthorised access to services. Guidance: use of services by remote users or over mobile links is exposed to breach of confidentiality through impersonation of a legitimate user or malware compromising the service, so controls should let users mutually authenticate their communications with the organization; where users cannot authenticate the organization, it should remind them that the authentication function is unavailable and of the risks generally incurred. Several encryption-based alternatives exist for identification and authentication; the threat when users cannot correctly identify the carrier is a man-in-the-middle attack.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.