Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• IAC-37.1_A01 the accounts, Technology Assets, Applications and/or Services (TAAS) and access scenarios for which replay-resistant Multi-Factor Authentication (MFA) is required are defined.
  Defined parameters: at a minimum, all privileged accounts and all network access to Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive / regulated data
  Assessment rigor: 1
  Origin: SCF Created
• IAC-37.1_A02 automated mechanisms enforce replay-resistant Multi-Factor Authentication (MFA) such that authenticator outputs cannot be reused to authenticate a subsequent session.
  Assessment rigor: 1
  Origin: SCF Created
• IAC-37.1_A03 where nonces are used, the verifier generates a unique nonce for each authentication attempt and rejects authenticator outputs that reuse a prior nonce.
  Assessment rigor: 3
  Origin: SCF Created
• IAC-37.1_A04 where one-time challenges are used, the verifier issues a unique challenge for each authentication attempt and rejects responses to previously issued challenges.
  Assessment rigor: 3
  Origin: SCF Created
• IAC-37.1_A05 where time-synchronous values are used, the verifier accepts each One-Time Password (OTP) value only within its validity window and rejects reuse of a previously accepted value.
  Assessment rigor: 3
  Origin: SCF Created
• IAC-37.1_A06 where channel binding is used, the authenticator output is cryptographically bound to the authenticated protected channel so that it cannot be replayed over a different channel.
  Assessment rigor: 3
  Origin: SCF Created
• IAC-37.1_A07 configurations of in-scope authentication mechanisms are reviewed to confirm replay-resistant Multi-Factor Authentication (MFA) remains enforced.
  Defined parameters: at least quarterly, and upon significant change to the authentication infrastructure
  Assessment rigor: 3
  Origin: SCF Created

Pedidos ligados

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.