Multi-factor authentication, or other logical and physical controls that supplement passwords to give risk mitigation commensurate with MFA; where MFA is not applied for access to industrial control workstations in control rooms regulated under 49 CFR parts 192 or 195, the owner/operator shall specify the compensating controls used to manage access.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.