Operate IAM + workforce security + training across the retail enterprise per NRF framework. IAM must (a) implement multi-factor authentication for all employees + contractors + service accounts where feasible + with priority for privileged access + remote access + admin consoles + e-commerce backend + payment processing + finance systems + HR systems + customer database access, (b) implement least privilege + separation of duties + role engineering for retail roles (store associate + manager + loss prevention + corporate office + IT + cybersecurity + finance + HR + supplier + contractor), (c) operate the joiner-mover-leaver lifecycle with documented SLA for new-hire access provisioning + role change + termination access revocation (target maximum hours for termination), (d) implement privileged access management with credential vaulting + session recording + JIT approval + emergency-access procedure. Workforce security must consider retail-specific characteristics including (a) high-volume seasonal hiring with limited onboarding security training, (b) high-turnover environment producing access-revocation challenges, (c) loss prevention personnel with elevated physical access, (d) contractor and vendor access for store technology + maintenance + visual merchandising + cleaning. Training and awareness must (a) baseline training for all employees on retail-specific risks (phishing + customer impersonation + return fraud + counterfeit + skimming detection at register + suspicious in-store behaviour), (b) role-specific training for cashiers + managers + IT + cybersecurity + privacy + HR + executives, (c) annual refresher + phishing simulation + escalation procedures + reporting channels.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.