Determines whether account types are defined and bounded, whether accounts are created, modified, disabled and removed under a documented process, and whether account use is monitored and periodically re-authorized.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.