Authentication Factor
What is Authentication Factor?
A category of credential used to verify identity, including knowledge factors, possession factors, and inherence factors like biometrics.
Frameworks that govern authentication factor
What the standards actually require on authentication factor
Requirements naming authentication factor across 6 standards, quoted from the control text.
Strong cryptography must be used to make all authentication factors unreadable both in transit and at rest on every system component. The testing procedures examine factor repositories and data transmissions.
8.3.2 · 8.3.2 Authentication factors unreadable with strong cryptography →Where software allows an authentication factor to be reset, the user is notified of the reset through a secondary channel.
ISM-2047 · Notifying users of authentication factor resets →(a) Allow the use of [Assignment: organization-defined authentication factors] that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded;
NIST800-AC-7(4) · AC-7(4) Unsuccessful Logon Attempts | Use of Alternate Authentication Factor →Agencies should consider adding location-based factors to authentication, for example requiring that the user is at an expected location (city, country or IP address) as well as presenting correct credentials before authentication succeeds.
new-zealand-information-security-manual-nzism::16.1.31.C.06 · 16.1.31.C.06 Consider location-based authentication factors →At least two credentials, each using a different authentication factor, shall be used (for example a possession factor together with a knowledge factor).
iso-iec-29115-2013-entity-authentication-assurance-framework::10.3.C1 · Authentication control #1: MultiFactorAuthentication (LoA3, LoA4) →Getting into a telecom room located outside a secure data centre needs more than one authentication factor. The assessor examines access controls and observes access events.
pci-3ds-core-security-standard::P2-7.1.4 · P2-7.1.4 Multi-factor entry to telecom rooms outside the data centre →Questions people ask about authentication factor
What is Authentication Factor?
Why is Authentication Factor important for compliance?
Which compliance frameworks address Authentication Factor?
Where can I learn more about Authentication Factor?
See how Authentication Factor applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.