This control repeats 16.7.44.C.01 word for word: the design of an agency's MFA should take into account identifying risks; the level of security and access control suited to each part of the organisation's systems, whether data, devices, equipment, storage, cloud or similar; a formal process for authorising user access to systems and entitlements; logging, monitoring and reporting of activity; reviewing logs for orphaned accounts and inappropriate access by users, failed authentication included; spotting errors and anomalies that may point to inappropriate or malicious activity; incident response; fixing errors; suspending or revoking access rights where policy is breached; and capacity planning.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.