Skip to content

Authentication

What is Authentication?

The process of verifying the identity of a user, device, or system. Common methods include passwords, biometrics, tokens, and multi-factor authentication (MFA).

Information Security

Related terms

MFA (Multi-Factor Authentication)Authorisation

Frameworks that govern authentication

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on authentication

Requirements naming authentication across 6 standards, quoted from the control text.

New Zealand Information Security Manual (NZISM)49 controls

Agencies should not rely on pre-shared keys to authenticate to wireless networks.

new-zealand-information-security-manual-nzism::18.2.20.C.03 · 18.2.20.C.03 Avoid pre-shared keys for wireless authentication →
Australian Information Security Manual45 controls

Multi-factor authentication is used to authenticate unprivileged users of systems.

ISM-0974 · Multi-factor authentication for unprivileged users →
NIST SP 800-53 Rev 543 controls

Accept and electronically verify Personal Identity Verification-compliant credentials.

NIST800-IA-2(12) · IA-2(12) Identification and Authentication (Organizational Users) | Acceptance of PIV Credentials →
PCI DSS 4.036 controls

Authentication policies and procedures must be documented and communicated to all users, and must include: guidance on choosing strong authentication factors; guidance on how users should protect their factors;

8.3.8 · 8.3.8 Authentication policies communicated to users →
ISO/IEC 29115:2013 - Entity Authentication Assurance Framework32 controls

Encrypted sessions shall be used, against session hijacking and man-in-the-middle.

iso-iec-29115-2013-entity-authentication-assurance-framework::10.3.C16 · Authentication control #16: EncryptedSession →
FBI CJIS Security Policy27 controls

Accept and electronically verify Personal Identity Verification-compliant credentials.

fbi-cjis-security-policy::IA-2(12) · IA-2(12) Identification and Authentication (Organizational Users) | Acceptance of PIV Credentials →

Questions people ask about authentication

What is Authentication?
The process of verifying the identity of a user, device, or system. Common methods include passwords, biometrics, tokens, and multi-factor authentication (MFA).
Why is Authentication important for compliance?
Authentication is a key concept in Information Security. Understanding authentication helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
What concepts are related to Authentication?
Key concepts related to Authentication include MFA (Multi-Factor Authentication), Authorisation. Understanding these interconnected concepts provides a more comprehensive view of Information Security requirements and helps organizations build holistic compliance programs.
Which compliance frameworks address Authentication?
Authentication appears in the requirement text of New Zealand Information Security Manual (NZISM), Australian Information Security Manual, NIST SP 800-53 Rev 5, PCI DSS 4.0, ISO/IEC 29115:2013 - Entity Authentication Assurance Framework. Across these standards we have identified 232 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Authentication?
Explore our compliance framework pages to see how authentication applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Authentication applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.