Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-IAM-14: Strong Authentication

What else in your programme already covers this

This control maps to 69 controls across 29 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP High · 6 controls

IA-2 Identification and Authentication (Organizational Users)
IA-2(1) MFA to Privileged Accounts
IA-2(2) MFA to Non-Privileged Accounts
IA-2(6) Identification and Authentication (Organizational Users) | Access to Accounts: separate Device (IA-2(6))
IA-8 Identification and Authentication (Non-Organizational Users)
MA-4 Nonlocal Maintenance

FedRAMP Moderate · 6 controls

IA-2 Identification and Authentication (Organizational Users)
IA-2(1) MFA to Privileged Accounts
IA-2(2) MFA to Non-Privileged Accounts
IA-2(6) Identification and Authentication (Organizational Users) | Access to Accounts: separate Device (IA-2(6))
IA-8 Identification and Authentication (Non-Organizational Users)
MA-4 Nonlocal Maintenance

PCI DSS 4.0 · 5 controls

8.3.1 8.3.1 Access authenticated with at least one factor
8.4.1 8.4.1 MFA for non-console administrative CDE access
8.4.2 8.4.2 MFA for all non-console CDE access
8.4.3 8.4.3 MFA for remote access that could reach CDE
8.5.1 8.5.1 MFA system resistant to replay and bypass

AWS Well-Architected Security Pillar · 4 controls

SEC01-BP02 Secure account root user and properties
SEC02-BP01 Use strong sign-in mechanisms
SEC02-BP02 Use temporary credentials
SEC09-BP03 Authenticate network communications

CMMC 2.0 · 4 controls

IA.L2-3.5.2 Authentication
IA.L2-3.5.3 Multifactor Authentication
IA.L2-3.5.4 Replay-Resistant Authentication
MA.L2-3.7.5 Nonlocal Maintenance

NIST SP 800-161 Rev 1 · 4 controls

161R1-IA-2 Identification and Authentication (Organizational Users)
161R1-IA-5 Authenticator Management
161R1-IA-9 Service Identification and Authentication
161R1-MA-4 Nonlocal Maintenance

NIST SP 800-53 Rev 5 · 4 controls

NIST800-IA-10 IA-10 Adaptive Authentication
NIST800-IA-2 IA-2 Identification and Authentication (Organizational Users)
NIST800-IA-8 IA-8 Identification and Authentication (Non-organizational Users)
NIST800-IA-9 IA-9 Service Identification and Authentication

UK Cyber Essentials · 4 controls

CE-AC.2 Authenticate Users Before Granting Access
CE-AC.7 MFA for Administrative Accounts
CE-AC.8 Passwordless Authentication
CE-SC.6 Multi-Factor Authentication for Cloud Services

ACSC Essential Eight · 3 controls

E8-MFA-ML1 Multi-Factor Authentication - Maturity Level 1
E8-MFA-ML2 Multi-Factor Authentication - Maturity Level 2
E8-MFA-ML3 Multi-Factor Authentication - Maturity Level 3

Azure Security Benchmark · 3 controls

ASBv3-IM-2 Protect identity and authentication systems
IM-4 Authenticate server and services
IM-6 Use strong authentication controls

CIS Controls v8 · 3 controls

CIS-6.3 Require MFA for Externally-Exposed Applications
CIS-6.4 Require MFA for Remote Network Access
CIS-6.5 Require MFA for Administrative Access

NIST SP 800-171 Rev 3 · 3 controls

03.05.03 Multi-Factor Authentication
03.05.04 Replay-Resistant Authentication
03.07.05 Nonlocal Maintenance

C5 (Germany) · 2 controls

C5-IDM-09 Authentication mechanisms
C5-PSS-05 Authentication Mechanisms

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-PR.AA-03 Users, services, and hardware are authenticated
NIST-CSF-PR.AA-04 Identity assertions are protected, conveyed, and verified

NIST SP 800-172 · 2 controls

3.5.1e Identification of Systems, Components, and Devices
3.5.3e Prohibit Connection of Unknown or Unverified System Components

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-13 Prefer Strong Authentication Where Possible

APEC Cross-Border Privacy Rules (CBPR) System · 1 control

CBPR-PR-30 Specific proportional safeguards in place

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

ASD37-20 Multi-factor authentication (Essential)

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-3 Information Security Category

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.1 · 1 control

IAM-13 Strong Authentication

DORA · 1 control

DORA-Art.9 Protection and prevention

HIPAA Security Rule · 1 control

164.312(d) Person or Entity Authentication (Standard)

ISO 27701:2019 · 1 control

6.6.4 System and application access control

NIS2 Directive · 1 control

Art.21.2.j Multi-factor or continuous authentication, secured communications and secured emergency communications

NIST SP 800-66 Rev 2 · 1 control

164.312(d) Person or Entity Authentication (Standard)

SOC 2 · 1 control

SOC2-CC6.6 CC6.6 Protection against threats from outside the system boundary

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 have you already done?

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-IAM-14 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 140 of 197 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 controls already carry evidence.

If you hold NIST SP 800-53 Rev 571.1% covered · 57 gaps If you hold FedRAMP Moderate60.4% covered · 78 gaps If you hold PCI DSS 4.060.4% covered · 78 gaps If you hold C5 (Germany)58.4% covered · 82 gaps If you hold ISO 27001:202256.3% covered · 86 gaps If you hold ISO 27002:202256.3% covered · 86 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 12 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 each Browse the graph free