The system administrator is notified when a person is no longer employed or no longer needs access and disables the account immediately for anyone with remote access, as soon as possible and within 48 hours for system administrators, IT personnel and service provider staff, and within a management-set period of no more than five days for everyone else; the written system describes the notification process and how access is prevented in the interval. (Group II ICP #12 and #13: notice within a week and disabling within two weeks; remote-access users disabled within a reasonable period set by management after prompt notice.)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.