Single Sign-On
What is Single Sign-On?
An authentication scheme that allows users to access multiple applications and services with one set of login credentials, improving user experience and security.
Terms that appear alongside single sign-on
Each of these is named in at least one of the same controls as single sign-on. The number is how many controls name both.
- single sign on sso 5 shared controls
- oauth 4 shared controls
- saml 4 shared controls
- nist 4 shared controls
- authentication 4 shared controls
- zero trust 3 shared controls
- role based access control 3 shared controls
- privileged access management pam 3 shared controls
Frameworks that govern single sign-on
What the standards actually require on single sign-on
Requirements naming single sign-on across 6 standards, quoted from the control text.
Use single sign-on so users authenticate once to reach applications and data across cloud and on-premises environments rather than maintaining separate credentials per application.
ASBv3-IM-5 · Use single sign-on (SSO) for application access →Support single sign-on through modern open standards such as SAML or OpenID Connect, available by default at no additional cost.
secure-by-design-a-guide-for-manufacturers-cisa::DF-3 · Single sign-on →A DSP seeks advice from the Digital Partnership Office before using enterprise single sign-on for its clients, and where SSO is implemented ensures that: disabling MFA is controlled by the DSP, not the client;
ato-digital-service-provider-dsp-operational-security-framework::SEC.AUTH.SSO · Enterprise single sign-on only on DPO advice and within set limits →Establish a centralised authentication system or single sign-on that authorises access from a central system.
awwa-cybersecurity-guidance-for-the-water-sector-american-water-works-association::SC-2 · SC-2 Centralised authentication or single sign-on →Federation and single sign-on. Control from NIST SP 800-190 framework, domain: NIST SP 800-190: Identity & Access in Cloud.
NIST190-09 · Federation and single sign-on →Provide a single sign-on capability for [Assignment: organization-defined system accounts and services].
NIST800-IA-2(10) · IA-2(10) Identification and Authentication (Organizational Users) | Single Sign-on →Questions people ask about single sign-on
What is Single Sign-On?
Why is Single Sign-On important for compliance?
Which compliance frameworks address Single Sign-On?
Where can I learn more about Single Sign-On?
See how Single Sign-On applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.