Implement Asset Management + Identity and Access Management + Cryptography per MTCS SS 584. Asset Management (ISO 27001 Annex A.8 alignment) - asset inventory (hardware + software + data + virtual + container + serverless) + asset classification + asset ownership + acceptable use + lifecycle + CMDB + ITAM + SAM + Software Bill of Materials (SBOM added 2024). Identity and Access Management (IAM) - identity lifecycle + provisioning + deprovisioning + role-based access control (RBAC) + attribute-based access control (ABAC) + Multi-Factor Authentication (MFA) mandatory for privileged + customer-facing + administrative access + Privileged Access Management (PAM) with session recording + just-in-time access + zero standing privileges + Federation (SAML + OAuth + OIDC) + Single Sign-On (SSO) + SCIM provisioning + LDAP/AD/Azure AD/Entra ID integration + Conditional Access policies. Cryptography (ISO/IEC 18033) - FIPS 140-2/140-3 validated cryptographic modules + Hardware Security Module (HSM) + Key Management Service (KMS) with key lifecycle + algorithm strength (AES-256 + RSA-3072+ + ECC P-256+ + SHA-256+) + Encryption at rest (database + filesystem + object storage) + Encryption in transit (TLS 1.2 minimum + 1.3 preferred + DKIM + DMARC + SPF for email) + PKI + Certificate Lifecycle Management + Post-Quantum Cryptography (PQC) preparation per NIST PQC (added MTCS 2024 - quantum-safe cryptography readiness). Tier 3 requires HSM + zero trust + dynamic policies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.