Implement authentication per NIST SP 800-63-4 Volume B (Authentication and Authenticator Lifecycle). Approve authenticator types per Section 4 covering (a) memorised secrets (Section 4.1), (b) look-up secrets (Section 4.2), (c) out-of-band devices (Section 4.3 with restrictions on SMS), (d) single-factor and multi-factor OTP devices (Section 4.4 + 4.5), (e) cryptographic software and hardware (Section 4.6 + 4.7 + 4.8 + 4.9), (f) syncable authenticators (NEW in Rev 4 per Section 4.10 covering FIDO2 passkeys that synchronise across user devices via cloud + provider attestation + cryptographic guarantees). Multi-Factor Authentication required at AAL2 per Section 5.2 + AAL3 per Section 5.3. Phishing-resistance per Section 4.13 specifies phishing-resistant authenticators (multi-factor cryptographic hardware + FIDO2 + smart card + PIV) and is REQUIRED at AAL3 + RECOMMENDED at AAL2 for high-risk transactions per OMB M-22-09.
What else in your programme already covers this
This control maps to 168 controls across 75 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization
NIST-CSF-PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions
NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties