[Autogenerated] requirement 8.6 is a strange one.
It's one of those that feels like it was added to the standard as a
result of a post compromise forensics report on it.
Is that physical authentication things such a certificate,
smart cause or tokens shouldn't be shared,
But they're used by and they're attributable to an individual.
This seems like a sensible common sense requirement,
but each user has their own something.
You have authentication factor, you know, just like their toothbrush.
They don't share it.
However, it could make providing remote access to suppliers complicated.
And so you often have to find ways of using additional
compensate Ori physical process controls.
In that type of scenario, the QoS A will look at policies and procedures,
check system settings and speak with system administrators
to validate this requirements in place.