Set and regularly review policies and rules for authentication and access rights: least privilege with segregation of duties; account lifecycle management with periodic inventories and review of operation histories, preventing misuse by unauthorised persons; strict limitation and management of privileged accounts (multi-factor authentication, double checks of operations, time-limited accounts); and management of outsourcees' access. Grant access only to individuals with a legitimate, approved business need who are trained and managed, according to the importance of systems and information; manage device (including credentials embedded in APIs) and user IDs and credentials (changing default passwords, password strength, automatic expiry, periodic access reviews by system owners); verify access rights before granting access, identify accessing users and log and attribute their operations; set authentication requirements by importance (MFA, risk-based authentication), using MFA in particular for remote access to critical systems; use mechanisms against fraud by third parties (SPF, DKIM and DMARC email authentication, secure file exchange, customer support and awareness); secure confidentiality, integrity and authenticity in single sign-on and federated authentication across systems or boundaries; and control, protect and record physical access to sensitive areas, computer rooms and data storage rooms.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.