Contracts with ASPs mandate: changing default passwords; no trivial passwords; centralised IAM with strong passwords, risk-based MFA, least privilege and SoD; privileged access through PIM or IAM; network segregation; firewall rules blocking unidentified outbound, reverse shells and backdoors; no remote connections from outside to the switch network; IP tables restricting SWIFT and switch environments; software integrity; masked development and test data; secure-coding certification and tested architecture with assurance to the bank or RBI; source code audits for critical applications; change management with test cases, approvals, deployment and rollback plans; database security event and backend access monitoring; log generation; user action audit logs for forensics; alerts on log setting changes; incident and BCP/DR responsibility even when subcontracted, with timely incident reporting to the bank; periodic VA/PT; sharing VA/PT reports and compliance; prompt vulnerability remediation; a written incident response procedure; a CSOC with log collection, SIEM correlation and threat updates; and PCI DSS and PCI SSF compliance as applicable.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.