Digital Certificate

Authenticate access to systems, applications and data, using multifactor authentication at minimum for privileged users and sensitive data, and digital certificates or equivalent strength for system identities.

Define, put in place and assess processes, procedures and technical measures that authenticate access to systems, applications and data, with multifactor authentication for least-privileged users and for access to sensitive data, and use digital certificates o...

Multifactor techniques such as tokens or digital certificates are used for employee access to the high-risk systems the risk assessment identifies; not applicable where there are none.

Further health information: ISO 17090-3 gives guidance on policy for issuing and using digital certificates in healthcare and on key management; the ISO/IEC 27002 control applies otherwise unchanged.

LoA4 gives very high confidence in the identity and is meant for high risk. It adds to LoA3 the requirement that human entities are proofed in person and that every secret or private cryptographic key is kept in tamper-resistant hardware;

All user access to system components by users and administrators must be authenticated with at least one of these factors: a knowledge factor (for example a password or passphrase); a possession factor (for example a smart card or token device);