Keep an up-to-date list of third party administrators and their access; control and promptly remove their access; allow no routine direct access to network equipment, only through provider-owned mediation points tied to a ticket or approved change; enforce security boundaries; require contractually that administrators segregate each customer provider's data and networks, use separate privileged access workstations and accounts per provider and protect their own networks; limit what they can reach; log and record all their access and obtain their logs; and require their networks to be tested to the same standard as the provider's (for example threat-led testing). Due: New contracts after 31 March 2024 (Tier 1) or 31 March 2025 (Tier 2); all contracts by 31 March 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.