11.6.1 The relevant entities shall implement secure authentication procedures and technologies based on …

Requirement

The relevant entities shall implement secure authentication procedures and technologies based on access restrictions and the policy on access control.

Guidance

• Authentication technologies are methods used to verify the identity of users, devices or systems before granting access to resources. Here are some common authentication technologies (indicative, non-exhaustive list):
  • password-based authentication,
  • passkeys,
  • two-factor authentication,
  • MFA (95),
  • biometric authentication,
  • token-based authentication, such as a one-time passcode (OTP),
  • smart cards,
  • Fast Identity Online 2 security keys,
  • certificate-based authentication,
  • SSO,
  • OpenID Connect.

Examples of evidence

• Access control policy documents outlining secure authentication procedures and technologies.
• Logs from authentication systems showing successful and failed authentication attempts, which demonstrate secure implementation.
• Evidence of the systems in place that enforce access controls, such as IAM solutions.
• Internal or external audit reports verifying the implementation of secure authentication procedures aligned with the access control policy.
• Documentation that shows the use of secure authentication and authorization protocols and demonstrates that these have been tested to confirm that they are implemented in a secure fashion.

1. Prezentare generală

1.1 Referințe

1.2 Cerințe identificate

1.3 Reglementări asociate

2. Cerințe identificate

3. Reglementări asociate

Tichete legate

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.