Agencies using SSH should apply the settings in the control's table: disallow SSH version 1 (Protocol 2); on hosts with several interfaces, have the SSH daemon listen only on the interfaces required (ListenAddress xxx.xxx.xxx.xxx); switch off connection forwarding (AllowTCPForwarding no); switch off gateway ports (Gatewayports no); prevent direct root login (PermitRootLogin no); switch off host-based authentication (HostbasedAuthentication no); switch off rhosts-based authentication (RhostsAuthentication no and IgnoreRhosts yes); refuse empty passwords (PermitEmptyPasswords no); set an appropriate login banner (Banner/directory/filename); set a login authentication timeout of 60 seconds or less (LoginGraceTime xx); and switch off X forwarding (X11Forwarding no).
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.