Crossfoot
Crossfoot / Controls / Authentication, unique IDs and multi-factor authentication
Draft v0.1.06 of 6 frameworks

Authentication, unique IDs and multi-factor authentication

Users are uniquely identified and strongly authenticated; MFA protects remote and administrative access.

Where it appears

SOC 2
CC6.1Logical access security software, infrastructure and architectures
PCI DSS 4.0
8.2User identification and related accounts are strictly managed
8.3Strong authentication for users and administrators is established and managed
8.4Multi-factor authentication is implemented
8.5MFA systems are configured to prevent misuse
NIST CSF 2.0
PR.AA-03Users, services and hardware are authenticated
ISO 27001:2022
A.5.17Authentication information
A.8.5Secure authentication
HIPAA Security Rule
164.312(d)Person or entity authentication
164.312(a)(2)(i)Unique user identification
NIST 800-53 r5
IA-2Identification and authentication (organizational users)
IA-5Authenticator management

Evidence auditors usually ask for

A typical starting list. Your assessor's request list is the one that counts.

  • Password / authentication policy
  • IdP or system configuration showing MFA enforcement and password settings
  • Screenshots or exports showing MFA coverage for remote access and admin accounts
  • Inventory of service/shared accounts with ownership and justification

Crosswalks that include this

SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0