Identification and Authentication

Identify system users, processes, and devices on your network and maintain a record of who or what has access.

Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.

Require multifactor authentication for privileged and network access.

Implement authentication mechanisms that prevent replay attacks.

Manage identifiers for users, processes, and devices throughout their lifecycle.

Disable identifiers when users, processes, or devices are no longer active.

Enforce minimum password complexity for user authentication.

Prohibit password reuse for a specified minimum number of generations.

Establish temporary passwords and require a change upon first logon.

Store and transmit passwords using approved cryptographic methods.

Obscure authentication feedback to prevent information disclosure.