User authentication on each CA system component: initial passphrases are pre-expired; group, shared and generic accounts are not allowed; passwords last no more than 90 days and no less than one day; passwords have eight or more characters combining letters, digits and special characters, or strength equivalent under NIST SP 800-63B; a user is locked out after five tries; a passphrase used in the previous twelve months cannot be reused; passwords are stored only encrypted or one-way transformed; passwords are never embedded in scripts; and log-on tokens require a biometric or a PIN or passphrase of eight or more digits or equivalent.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.