MDS2 (Medical Device) PAUT: PAUT Person authentication: disclose unique accounts, external authentication, lockout, default accounts, password rules, MFA, SSO and credential storage

Discloses how the device can be set up to authenticate the people who use it: whether it supports and enforces a unique ID and password for every user and role, service accounts included (PAUT-1) and enforces authentication with them (1.1); whether users can be authenticated through an external service such as Active Directory, NDS, LDAP or OAuth (PAUT-2); whether users can be locked out after a number of failed logons (PAUT-3); whether every default account (technician service, administrator) is documented (PAUT-4); whether all passwords can be changed (PAUT-5); whether account passwords can be forced to meet organisation-specific complexity rules, answered Yes only if complexity is configurable (PAUT-6); whether passwords can expire periodically and how often (PAUT-7); multi-factor authentication (PAUT-8); single sign-on (PAUT-9); disabling or locking user accounts (PAUT-10); biometric logins (PAUT-11); physical tokens such as badge access (PAUT-12); group authentication such as a hospital team (PAUT-13); and whether the application or device stores or manages authentication credentials (PAUT-14) and stores them securely (14.1).