FprEN 18031-3:2024 AUM-1: Authenticate entities before they read confidential, change sensitive, or use financial and security functions (network, user and machine interfaces)

What does AUM-1 require?

Where an ACM-1 access control mechanism governs access over a network interface (AUM-1-1), a user interface (AUM-1-2) or a machine interface (AUM-1-3), it relies on an authentication mechanism whenever the access would let an entity read confidential data (financial data, financial function configuration or security parameters classed confidential), alter sensitive data (the same three classes where classed sensitive), or invoke a financial or security function. Unlike Part 2, this Part states no exceptions to the requirement.