Multi-factor authentication should be used at login for online financial services; customer passwords should be end-to-end encrypted in transit and verified only in hardened or tamper-resistant systems; transaction signing (for example digital signatures) should authorise high-risk activities such as changes to sensitive customer data, adding third-party payees, high-value transfers and changes to transfer limits; risk-based or adaptive authentication may supplement these; time-based OTPs should be valid as briefly as practicable; biometric data and credentials should be encrypted in storage and transit; biometric false acceptance and false rejection rates should be calibrated to the risk; soft token provisioning should verify identity, block rooted or jailbroken devices and bind the device; sessions and their encryption should stay intact, with hijack detection and automatic termination after inactivity; alternate controls such as maker-checker for corporate customers should be risk assessed; and credentials such as biometric templates and passwords should be stored in a form resistant to reverse engineering, with a process to revoke and replace compromised credentials.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.