Computer systems, including gaming and entertainment applications, are logically secured by passwords, biometrics or other Board-approved means. Password parameters: changed at least every 90 days; at least 8 characters combining at least two of upper case, lower case, numeric and special characters; not reused for 18 months or within the last ten changes; accounts locked after 3 failed logins. Service and generic accounts are excluded. The written system states, per layer, whether and how far each is configurable.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.