Identification and authentication policies and procedures designed to prevent unauthorized access must include a schedule for resetting memorized secret authenticators (passwords), and documented mitigation measures, with a completion timeframe, for components of Critical Cyber Systems whose passwords will not be reset on that schedule.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.