The FI must ensure every administrative account on any operating system, database, application, security appliance or network device is secured to prevent unauthorised access or use. The FAQ describes grant on need-to-use with an approval procedure, periodic review and revocation, and preventive controls such as password complexity and expiry, dual control of passwords and segregation of duties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.