Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- IAC-15_A01 for password-based authentication, a list of commonly used, expected or compromised passwords is maintained and updated frequently and when organizational passwords are suspected to have been compromised directly or indirectly.
Assessment rigor: 1
Origin: 53A_R5_IA-05(01)(a) - IAC-15_A02 for password-based authentication when passwords are created or updated by users, the passwords are verified not to be found on the list of commonly used, expected or compromised passwords.
Assessment rigor: 1
Origin: 53A_R5_IA-05(01)(b) - IAC-15_A03 for password-based authentication, passwords are only transmitted over cryptographically protected channels.
Assessment rigor: 1
Origin: 53A_R5_IA-05(01)(c) - IAC-15_A04 for password-based authentication, passwords are stored using an approved salted key derivation function, preferably using a keyed hash.
Assessment rigor: 3
Origin: 53A_R5_IA-05(01)(d) - IAC-15_A05 for password-based authentication, immediate selection of a new password is required upon account recovery.
Assessment rigor: 3
Origin: 53A_R5_IA-05(01)(e) - IAC-15_A06 for password-based authentication, user selection of long passwords and passphrases is allowed, including spaces and all printable characters.
Assessment rigor: 3
Origin: 53A_R5_IA-05(01)(f) - IAC-15_A07 for password-based authentication, automated tools are employed to assist the user in selecting strong password authenticators.
Assessment rigor: 3
Origin: 53A_R5_IA-05(01)(g) - IAC-15_A08 organization-defined composition and complexity rules for passwords are enforced.
Assessment rigor: 2
Origin: 53A_R5_IA-05(01)(h) 171A_3.5.7[c] - IAC-15_A09 password composition and complexity rules are defined.
Assessment rigor: 2
Origin: 171A_3.5.7[a] 171A_R3_A.03.05.07.ODP[02] - IAC-15_A10 password change of character requirements are defined.
Assessment rigor: 2
Origin: 171A_3.5.7[b] - IAC-15_A11 minimum password complexity requirements, as defined, are enforced when new passwords are created.
Assessment rigor: 2
Origin: 171A_3.5.7[c] - IAC-15_A12 minimum password change of character requirements as defined are enforced when new passwords are created.
Assessment rigor: 2
Origin: 171A_3.5.7[d] - IAC-15_A13 the following composition and complexity rules for passwords are enforced: <A.03.05.07.ODP[02]: rules>.
Defined parameters: SDP values: (1) Must have a minimum length of 16 characters. (2) Contains a string of characters that does not include the user’s account name or full name.
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.05.07.f
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | Password-Based Authentication |
- Secure Controls Framework -
The Secure Controls Framework® (SCF)
"The SCF is the Common Controls Framework™ (CCF), the world's most comprehensive cybersecurity and data privacy metaframework - it is also free to use. The entire concept is building secure, compliant and resilient capabilities in the most efficient and cost-effective manner possible.
The SCF is more than just a unified control catalog, since its included content creates a playbook for Governance, Risk & Compliance (GRC) capabilities. Used globally by organizations of every size, the SCF is a robust and scalable solution for security, compliance and resilience controls. As a comprehensive security framework, the SCF maps 1,400+ controls across 200+ laws, regulations, and industry frameworks so you can implement once and comply everywhere.
Like it or not, cybersecurity is a protracted war on an asymmetric battlefield, where the threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and data privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts. Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference, since we feel it is too important to wait for someone else to fix the problems that exist.
The SCF is made up of volunteers, mainly specialists within the cybersecurity profession, who focus on GRC and the cybersecurity side of data privacy. These are auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe these topics on a daily basis. The end product is "expert-derived content" that makes up the SCF." https://securecontrolsframework.com/Terms & Conditions
The SCF End User License Agreement (EULA) governs the use of the Secure Controls Framework® (SCF) under the Creative Commons Attribution-No Derivatives 4.0 International Public License.