Log-on security tokens such as smart cards require a usage-authentication mechanism, a biometric or a PIN or passphrase of at least eight decimal digits or equivalent, and are exempt from the password expiry rules.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.