Implement OT access control per NIST SP 800-82 Rev 3 Chapter 6 (Security Architecture) + Chapter 7 (Applying the Cybersecurity Framework) covering identity + authentication + access management + remote access. Identity and access management must support (a) role-based access aligned to OT operational roles (operator + engineer + maintenance + vendor + reader-only + administrator), (b) multi-factor authentication for human users at every level above the field network (Level 2 and above) with hardware-token preferred for engineering and administrative roles, (c) emergency-bypass procedures documented and authorised that retain audit trail, (d) shared accounts only for legacy systems that genuinely cannot support individual identification + with compensating monitoring, (e) certificate-based machine-to-machine authentication where feasible, (f) directory federation between OT and IT only via dedicated identity broker not direct trust. Remote access (vendor + maintenance + remote engineering) must use (a) jump host or bastion architecture, (b) privileged access management with credential vaulting, (c) session recording for accountability and forensics, (d) just-in-time access with time-bounded approval workflow, (e) MFA at the jump host even when downstream targets cannot support MFA, (f) explicit network policy revoking access on session end. Authentication credentials and tokens specific to OT must be managed via OT-aware secrets management aligned with safety system requirements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.