NIST SP 800-63-4
Authentication and Authenticator Types

NIST SP 800-63-4 NISTSP63R4-3: Authentication: Authenticator Types, MFA, Phishing-Resistance, and Syncable Authenticators

Implement authentication per NIST SP 800-63-4 Volume B (Authentication and Authenticator Lifecycle). Approve authenticator types per Section 4 covering (a) memorised secrets (Section 4.1), (b) look-up secrets (Section 4.2), (c) out-of-band devices (Section 4.3 with restrictions on SMS), (d) single-factor and multi-factor OTP devices (Section 4.4 + 4.5), (e) cryptographic software and hardware (Section 4.6 + 4.7 + 4.8 + 4.9), (f) syncable authenticators (NEW in Rev 4 per Section 4.10 covering FIDO2 passkeys that synchronise across user devices via cloud + provider attestation + cryptographic guarantees). Multi-Factor Authentication required at AAL2 per Section 5.2 + AAL3 per Section 5.3. Phishing-resistance per Section 4.13 specifies phishing-resistant authenticators (multi-factor cryptographic hardware + FIDO2 + smart card + PIV) and is REQUIRED at AAL3 + RECOMMENDED at AAL2 for high-risk transactions per OMB M-22-09.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 151 controls across 68 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 4 controls

  • AWWA-1.3 Security Awareness and Training
  • AWWA-2.1 User Access Management
  • AWWA-2.2 Authentication Mechanisms
  • AWWA-2.4 Physical Access Controls

BSI IT-Grundschutz · 4 controls

  • BSI-02 Access enforcement and least privilege
  • BSI-03 Multi-factor authentication requirements
  • BSI-04 Remote access controls
  • BSI-05 Wireless access restrictions

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 4 controls

ISO 27799:2025 · 4 controls

  • ISO27799-01 ePHI access controls and authorization
  • ISO27799-08 Information access management
  • ISO27799-12 Unique user identification and authentication
  • ISO27799-17 Facility access controls

ISO/IEC 27043:2015 · 4 controls

  • ISO27043-11 Access control policy and enforcement
  • ISO27043-13 Authentication and password management
  • ISO27043-14 Privileged access management
  • ISO27043-15 Access review and recertification

ISO/SAE 21434 · 4 controls

  • ISO21434-12 User access management and provisioning
  • ISO21434-13 Authentication and password management
  • ISO21434-14 Privileged access management
  • ISO21434-15 Access review and recertification

OWASP Top 10 for LLM Applications 2025 · 4 controls

  • OWASPLLM-1 Prompt Injection and System Prompt Leakage (LLM01 + LLM07)
  • OWASPLLM-2 Improper Output Handling and Misinformation (LLM05 + LLM09)
  • OWASPLLM-3 Sensitive Information Disclosure and Privacy (LLM02)
  • OWASPLLM-6 Excessive Agency and Unbounded Consumption (LLM06 + LLM10)

OWASP Top 10:2025 · 4 controls

API 1164 · 3 controls

  • API1164-06 Access Control
  • API1164-07 Remote Access
  • API1164-09 Patch and Vulnerability Management

ASD Strategies to Mitigate Cyber Security Incidents · 3 controls

  • ASD37-18 Restrict administrative privileges (Essential)
  • ASD37-20 Multi-factor authentication (Essential)
  • ASD37-23 Protect authentication credentials (Excellent)

FFIEC Cybersecurity Assessment Tool (CAT) · 3 controls

  • CAT-D3-1 Preventative controls
  • CAT-D4-3 Third-party access controls
  • CAT-IRP-4 Organizational characteristics

IEC 62443 · 3 controls

  • IEC62443-07 Personnel risk assessment
  • IEC62443-08 Electronic access perimeter management
  • IEC62443-10 Revocation of access procedures

ISO/IEC 27019:2024 · 3 controls

  • ISO27019-07 Personnel risk assessment
  • ISO27019-08 Electronic access perimeter management
  • ISO27019-10 Revocation of access procedures

ISO/IEC 29115:2013 - Entity Authentication Assurance Framework · 3 controls

  • 29115-11 Mapping other authentication schemes
  • 29115-12.1 Exchanging authentication results
  • 29115-12.2 Controls for mitigating threats

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization
  • NIST-CSF-PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions
  • NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

NIST SP 1800-32 · 3 controls

OWASP API Security Top 10 - 2023 · 3 controls

  • OWASPAPI-1 Broken Object Level Authorization (BOLA) and BFLA
  • OWASPAPI-2 Broken Authentication and Token Management
  • OWASPAPI-3 Broken Object Property Level Authorization (BOPLA)

OWASP DevSecOps Maturity Model (DSOMM) · 3 controls

  • DSOMM-1 Culture, Organization, Education, and Governance
  • DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management
  • DSOMM-4 Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing

South Korea ISMS-P · 3 controls

  • ISMSP-AC-01 Access Control Policy
  • ISMSP-AC-03 Authentication Mechanisms
  • ISMSP-AC-04 Network Access Control

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 2 controls

  • DSO-2 Data Security
  • DSO-3 Data Access Management

Florida Digital Bill of Rights (FDBR) · 2 controls

  • FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704)
  • FDBR-SensitiveData-Children-VoiceFacial Sensitive Data, Children's Privacy and Voice/Facial Recognition (Fla. Stat. 501.711, 501.1735)

ISO/IEC 27010:2015 · 2 controls

  • 27010-9.1 Access Control to Shared Information
  • 27010-9.2 Authentication of Sources

ISO/IEC 27011:2024 · 2 controls

  • 27011-5.3 Segregation of duties
  • 27011-8.1 User Endpoint Devices

ITU-T X.805 - Security Architecture for End-to-End Communications · 2 controls

Illinois Biometric Information Privacy Act (BIPA) · 2 controls

  • BIPA-SEC5-1 Biometric Identifier Definition
  • BIPA-SEC5-2 Biometric Information Definition

NIST Privacy Framework · 2 controls

  • NISTPF-3 Control-P - Privacy Controls, Data Management, and Disassociated Processing
  • NISTPF-5 Protect-P Access Control (PR.AC-P)

NIST SP 800-190 · 2 controls

OWASP ASVS · 2 controls

Protective Security Policy Framework (PSPF) Release 2026 · 2 controls

  • PSPF24-2 Information Security, Cybersecurity Maturity, Essential Eight
  • PSPF24-4 Physical Security

AML/CTF Act 2006 (Australia) · 1 control

  • AMLCTF-35 Identity Verification Standard

APPI · 1 control

  • APPI-A26 Report of Leakage to the Commission and Notification to the Person

Annex 11 to EU GMP - Computerised Systems · 1 control

Armenia Law on Protection of Personal Data (2015) · 1 control

Bahrain PDPL · 1 control

Bank Secrecy Act / Anti-Money Laundering (BSA/AML) · 1 control

Canada ITSG-33 - IT Security Risk Management · 1 control

  • CA-ITSG33-SC-01 Security Control Catalogue

FIDO2 / WebAuthn · 1 control

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

  • FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

  • UAE-PDPL-Art.6_7 Sensitive personal data and children's data (UAE PDPL Articles 6-7)

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

IATA Operational Safety Audit (IOSA) Standards Manual · 1 control

  • IATA-IOSA-Section8-SEC-SecurityManagement-AVSEC IATA IOSA Section 8 - SEC Security Management + Aviation Security Programme (AVSEC) + ICAO Annex 17 Alignment

ICAO Annex 17 - Aviation Security (AVSEC) · 1 control

  • ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18)

IEC 62351 - Power Systems Communication Security · 1 control

  • 62351-8 Role-based access control (RBAC)

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 1 control

  • ISO-15189-6.2 Personnel

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM) · 1 control

  • ISO-19650-2-5.7 Information model delivery

ISO 28001:2007 Supply Chain Security Management · 1 control

  • ISO28001-PS-01 Facility Security

ISO/IEC 20000-1:2018 · 1 control

  • ISO20000-15 Access management for services

ISO/IEC 23837:2023 · 1 control

  • 23837-1.7.3 Authentication and classical post-processing

ISO/IEC 27400:2022 · 1 control

  • 27400-6.1 Secure Device Design

ITIL 4 · 1 control

  • ITIL4-15 Access management for services

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 1 control

New Jersey Data Privacy Act · 1 control

  • NJDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal

OWASP MASVS · 1 control

Privacy Act 1988 (Australia) · 1 control

  • AUPRV-4 APP 10-11 Quality, Security of Personal Information

Regulation on the European Health Data Space (EHDS) · 1 control

  • EHDSREG-6 Phased Application and Enforcement

Russia Federal Law on Personal Data (152-FZ) · 1 control

  • RUSPD-2 Lawful Basis, Consent, Notice

SWIFT CSCF · 1 control

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

  • IM8-SEC.2 Access Control

South Korea PIPA · 1 control

  • PIPA-Cross-Border-Transfer-Articles-28-8-28-9-Adequacy-Standard-Contract-Certification-EU Korea PIPA Cross-Border Transfer + Articles 28-8 + 28-9 + Adequacy + EU 2021

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

TEFCA - Trusted Exchange Framework and Common Agreement · 1 control

  • TEFCAREC-1 Common Agreement Conformance and Onboarding

Turkey KVKK · 1 control

  • TURKEYKVKK-2 Information Notice and Data Subject Rights

US Automated Commercial Environment (ACE) - CBP Trade Data Requirements · 1 control

  • ACE-CR-4 Cargo Release Authorization

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties · 1 control

  • CPSC-CS.2 Authentication and Access Controls

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements · 1 control

  • USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR)

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements · 1 control

  • CYB-2 Account Security Measures

USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement) · 1 control

  • USMCADIGITAL-2 Personal Information Protection and Consumer Protection

Vermont Data Privacy and Online Surveillance Act · 1 control

  • VERMONTAICDA-3 Bias Testing, Discrimination Prevention, Transparency

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 151 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-63-4 controls