Password procedures for users and customers are set and applied considering legal requirements and external threats (complexity, change of initial password, change interval), users and customers are told they are responsible for their passwords, administrator passwords get separate protection, and the customer password procedure is published.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.