Passwords and other memorised secrets should be salted and then hashed through a suitable one-way key derivation function. The control refers to paragraph 17.2.14 for background on salting.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.