CMMC v2.0
3.5 IDENTIFICATION AND AUTHENTICATION
IA.L1-3.5.2
Authenticate (or verify) the identities of users processes or devices as a prerequisite to allowing access to organizational systems
Individual authenticators include the following: passwords key cards cryptographic devices and one-time password devices. Initial authenticator content is the actual content of the authenticator for example the initial password. In contrast the requirements about authenticator content include the minimum password length. Developers ship system components with factory default authentication credentials to allow for initial installation and configuration. Default authentication credentials are often well known easily discoverable and present a significant security risk.Systems support authenticator management by organization-defined settings and restrictions for various authenticator characteristics including minimum password length validation time window for time synchronous one-time tokens and number of allowed rejections during the verification stage of biometric authentication. Authenticator management includes issuing and revoking when no longer needed authenticators for temporary access such as that required for remote maintenance. Device authenticators include certificates and passwords.[SP 800-63-3] provides guidance on digital identities
Click here to Start your FREE trial today!
What is a Cybersecurity Compliance Framework?
You don’t need to clutter your security and privacy programs with an ever-increasing number of tools as they become more sophisticated. The Lionfish platform offers a one-stop solution to track progress and monitor any framework, from custom-built ones to highly-specialized and in-demand top security and privacy frameworks and certifications.
With the Lionfish platform, every framework is supported with guided scoping, policies, controls, automated evidence collection, and continuous monitoring, ensuring efficient preparation for audits or attestation in minimal time.
The Lionfish platform is compatible with a wide range of security and privacy frameworks, including:
- CMMC v2
- HIPAA
- NERC CIP-002 through CIP-014 Revision 6
- NIST 800-171
- NIST 800-172
- PCI (Payment Card Industry Security Standard)
- SOC 2
- NIST 800-53
- NIST SP800-161 Supply Chain Risk Management
- NIST-CSF
- CIS Framework Controls V8
Click here to Start your FREE trial today!