Quarterly, personnel independent of authorization and provisioning review a representative sample of at least 10% (maximum 25) of users in each gaming application's access listing, determining whether functions are used as authorized, segregation is adequate, terminated users were disabled within the required period, passwords were changed within 90 days, and group memberships carry no inappropriate functions, keeping evidence of the accounts reviewed, results and dates. It applies to systems generating revenue, credit instrument, statistical or other MICS-required records, not to entertainment tax applications. (Group II ICP #14: at least 10%, no maximum.)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.