Per OWASP ASVS V2 + V2.4: implement strong authentication + credential storage. Requirements include (a) implement password strength requirements aligned with NIST SP 800-63B + reject compromised passwords against published breach lists + (b) implement secure password storage using salted strong adaptive hashing (Argon2 + bcrypt + PBKDF2 + scrypt at appropriate work factor) + (c) implement multi-factor authentication for sensitive operations + privileged accounts + (d) implement credential lifecycle management including reset + change + rotation + revocation + (e) implement rate limiting + account lockout against brute force + credential stuffing + (f) implement secure recovery (no security questions for high-assurance + identity verification for password reset + (g) align to OAuth 2.0 + OIDC + FIDO2/WebAuthn standards where applicable.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.