When ranking systems that are vulnerable to future cryptographically relevant computers, agencies should weigh these factors: (1) whether the system is a high value asset under agency requirements; (2) whether it protects sensitive information, for example root keys, signing keys, key stores, passwords, personal information and classified information; (3) whether other systems, inside or outside the agency, rely on the cryptographic protections of the vulnerable system; and (4) how long the data has to stay protected.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.