11.6.4 The relevant entities shall regularly review the authentication procedures and technologies at …

Requirement

The relevant entities shall regularly review the authentication procedures and technologies at planned intervals.

Guidance

• Conduct periodic audits of authentication procedures and technologies to ensure they remain up to date, where appropriate and effective against emerging threats.
• Stay up to date on advancements in authentication technology and integrate new methods as they become available.

Examples of evidence

• Internal or external audit reports detailing the results of periodic audits of authentication procedures and technologies.
• Logs showing the implementation of new authentication technologies and methods as they become available

Tips: guidance

• Advise any user with access to or using authentication information to comply with the following.
  • Secret authentication information, such as passwords, is kept confidential. Personal secret authentication information is not to be shared with anyone. Secret authentication information used in the context of identities linked to multiple users or linked to non-personal entities is solely shared with authorised persons.
  • Affected or compromised authentication information is changed immediately upon notification of or any other indication of a compromise.
  • When passwords are used as authentication information, strong passwords according to best practice recommendations are selected. For example, passwords are not based on anything somebody else can easily guess or obtain using person-related information (e.g. names, telephone numbers and dates of birth); passwords are not based on dictionary words or combinations thereof; use easy to remember passphrases and try to include alphanumerical and special characters; passwords should have a minimum length.
  • The same credentials are not used across different network and information systems.
  • The obligation to follow these rules is also included in the terms and conditions of employment.

Tips: examples of evidence

• Documentation of training sessions for employees on secure authentication practices and technologies.
• Records of awareness programmes or communications to employees about the importance of secure authentication.

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

3. Relaterede reguleringer

Linkede sager

• ENISA -