Test regularly that logging works; maintain and review number analysis reference data used to configure signalling equipment; conduct threat modelling to inform risk assessments; for equipment facing high-end attacks use trusted boot and periodic rebuild to a known-good state where possible; block anomalous or malicious customer equipment activity that could affect the network; manage service accounts under least privilege in a central repository, dedicated to their task, with credentials stored and rotated by a privileged access solution; document APIs centrally and implement them securely with minimal exposure; and disable unused ports, protocols and services. Due: Tier 1 and Tier 2 by 31 December 2029 (new in v1.1).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.