Skip to content

Security Token

What is Security Token?

A physical or digital device used to authenticate a user's identity. Security tokens generate one-time passwords or cryptographic keys and are used as the 'something you have' factor in multi-factor authentication.

Information Security

Frameworks that govern security token

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on security token

Requirements naming security token across 4 standards, quoted from the control text.

COBIT 20191 control

Sensitive I&T assets, for example negotiable instruments, special forms, security tokens and printers used for special purposes, are governed through suitable physical safeguards, inventory management and accounting practices: procedures cover how sensitive do...

cobit-2019::DSS05.06 · DSS05.06 Manage sensitive documents and output devices →
ISMAP (Japan)1 control

ISMAP Identity and Access Management requires comprehensive IAM controls covering customer + CSP + administrative + service-to-service identities.

ISMAP-Identity-Access-MFA-Privileged-Federation-SSO-API-Tokens-CloudIAM-PIV-PASETO · ISMAP Identity and Access Management - Cloud IAM + Multi-Factor Authentication + Privileged Access + Federation/SSO + API Security + Access Tokens + My Number Card Integration + Government IAM →
NIST SP 800-53 Rev 51 control

Produce, control, and distribute asymmetric cryptographic keys using [Selection: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates;

NIST800-SC-12(3) · SC-12(3) Cryptographic Key Establishment and Management | Asymmetric Keys →
PCI PIN Security1 control

Log-on security tokens such as smart cards require a usage-authentication mechanism, a biometric or a PIN or passphrase of at least eight decimal digits or equivalent, and are exempt from the password expiry rules.

pci-pin-security::A2:25-8.9 · PCI PIN A2:25-8.9 →

Questions people ask about security token

What is Security Token?
A physical or digital device used to authenticate a user's identity. Security tokens generate one-time passwords or cryptographic keys and are used as the 'something you have' factor in multi-factor authentication.
Why is Security Token important for compliance?
Security Token is a key concept in Information Security. Understanding security token helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Security Token?
Security Token appears in the requirement text of COBIT 2019, ISMAP (Japan), NIST SP 800-53 Rev 5, PCI PIN Security. Across these standards we have identified 4 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Security Token?
Explore our compliance framework pages to see how security token applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Security Token applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.