Baseline: unique accounts for every user and administrator, security requirements for privileged account types and no sharing of those accounts, with compensating controls such as physical controls where systems cannot support unique accounts; prompt modification, deletion or deactivation of accounts of people who no longer need access or have left; access control policies for local and remote users with procedures for approving and enforcing remote and third-party connections; segregation of duties or compensating controls; and changing all default passwords on new software and hardware at installation, with compensating controls where not technically feasible (for example hard-coded passwords). Enhanced: restrict physical access to control systems and networks, apply stricter identity and access management (authenticators, password construction, access control), monitor physical and remote access to critical pipeline cyber assets, and use mechanisms to support account management.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.