Assessment Objective
Determine if:
- multi-factor authentication for access to privileged accounts is implemented.
- multi-factor authentication for access to non-privileged accounts is implemented.
Assessment Methods
Examine
- identification and authentication policy and procedures
- system design documentation
- list of system accounts
- system configuration settings
- system audit records
- system security plan
- other relevant documents or records
Interview
- personnel with system operations responsibilities
- personnel with account management responsibilities
- personnel with information security responsibilities
- system developers
- system administrators
Test
- mechanisms for supporting or implementing a multi-factor authentication capability
Ticket collegati
| Tipo di collegamento | Ticket |
|---|---|
| blocks | 03.05.03 Multi-Factor Authentication |