11.6.1 The relevant entities shall implement secure authentication procedures and technologies based on …

Requirement

The relevant entities shall implement secure authentication procedures and technologies based on access restrictions and the policy on access control.

Guidance

• Authentication technologies are methods used to verify the identity of users, devices or systems before granting access to resources. Here are some common authentication technologies (indicative, non-exhaustive list):
  • password-based authentication,
  • passkeys,
  • two-factor authentication,
  • MFA (95),
  • biometric authentication,
  • token-based authentication, such as a one-time passcode (OTP),
  • smart cards,
  • Fast Identity Online 2 security keys,
  • certificate-based authentication,
  • SSO,
  • OpenID Connect.

Examples of evidence

• Access control policy documents outlining secure authentication procedures and technologies.
• Logs from authentication systems showing successful and failed authentication attempts, which demonstrate secure implementation.
• Evidence of the systems in place that enforce access controls, such as IAM solutions.
• Internal or external audit reports verifying the implementation of secure authentication procedures aligned with the access control policy.
• Documentation that shows the use of secure authentication and authorization protocols and demonstrates that these have been tested to confirm that they are implemented in a secure fashion.

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

3. Relaterede reguleringer

Linkede sager

• ENISA -