NIST SP 800-66 Rev 2 164.312(d): Person or Entity Authentication (Standard)

What else in your programme already covers this

This control maps to 86 controls across 27 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 8 controls

10.2.1.1 Log all user access to CHD
2.2.2 Vendor default accounts are managed as follows: • If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6. • If the vendor default account(s) will not be used,
8.2.1 All users are assigned a unique ID before access to system components or cardholder data is allowed
8.3.1 All user access to system components for users and administrators is authenticated via at least one of the following authentication factors: • Something you know, such as a password or passphrase. • Something you
8.4.1 MFA is implemented for all non-console access into the CDE for personnel with administrative access
8.4.2 MFA is implemented for all non-console access into the CDE
9.2.3 Physical access to networking and telecommunications hardware restricted
7.3.1 An access control system(s) is in place that restricts access based on a user's need to know and covers all system components

NIST SP 800-53 Rev 5 · 6 controls

NIST800-AU-10 Non-repudiation. Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [organization-defined]
NIST800-IA-11 Re-authentication
NIST800-IA-12 Identity proofing
NIST800-IA-2 Identification and authentication of organizational users
NIST800-IA-5 Authenticator management
NIST800-IA-8 Identification and authentication of non-organizational users

CIS Controls v8 · 5 controls

CIS-5.2 Use Unique Passwords
CIS-6.3 Require MFA for Externally-Exposed Applications
CIS-6.4 Require MFA for Remote Network Access
CIS-6.5 Require MFA for Administrative Access
CIS-6.6 Establish and Maintain an Inventory of Authentication and Authorization Systems

FedRAMP High · 5 controls

IA-1 Policy and Procedures
IA-2 Identification and Authentication (Organizational Users)
IA-2(1) MFA to Privileged Accounts
IA-5 Authenticator Management
IA-8 Identification and Authentication (Non-Organizational Users)

FedRAMP Moderate · 5 controls

IA-1 Policy and Procedures
IA-2 Identification and Authentication (Organizational Users)
IA-2(1) MFA to Privileged Accounts
IA-5 Authenticator Management
IA-8 Identification and Authentication (Non-Organizational Users)

UK Cyber Essentials · 5 controls

CE-AC.2 Authenticate Users Before Granting Access
CE-AC.7 MFA for Administrative Accounts
CE-AC.8 Passwordless Authentication
CE-SC.4 Authenticate Users Before Access
CE-SC.6 Multi-Factor Authentication for Cloud Services

NIST SP 800-171 Rev 3 · 4 controls

03.05.01 User Identification and Authentication
03.05.03 Multi-Factor Authentication
03.05.04 Replay-Resistant Authentication
03.05.12 Authenticator Management

NIST SP 800-53 Rev 5 LOW · 4 controls

IA-1 Policy and Procedures
IA-2 Identification and Authentication (Organizational Users)
IA-5 Authenticator Management
IA-8 Identification and Authentication (Non-Organizational Users)

NIST SP 800-53 Rev 5 MODERATE · 4 controls

IA-1 Policy and Procedures
IA-2 Identification and Authentication (Organizational Users)
IA-5 Authenticator Management
IA-8 Identification and Authentication (Non-Organizational Users)

NIST SP 800-53 Revision 5.1 HIGH · 4 controls

IA-1 Policy and Procedures
IA-2 Identification and Authentication (Organizational Users)
IA-5 Authenticator Management
IA-8 Identification and Authentication (Non-Organizational Users)

SOC 2 · 4 controls

SOC2-CC6.1 Implements logical access security software, infrastructure and architectures over protected information assets
SOC2-CC6.2 Prior to granting access, registration and authorization processes are established
SOC2-CC6.3 Role-based access and least privilege are enforced
SOC2-CC6.6 Measures against threats outside system boundaries are implemented

ACSC Essential Eight · 3 controls

E8-MFA-ML1 Multi-Factor Authentication - Maturity Level 1
E8-MFA-ML2 Multi-Factor Authentication - Maturity Level 2
E8-MFA-ML3 Multi-Factor Authentication - Maturity Level 3

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 3 controls

ANSSI-HYG-10 Define and Verify Password Selection and Sizing Rules
ANSSI-HYG-12 Change Default Authentication Elements on Equipment and Services
ANSSI-HYG-13 Prefer Strong Authentication Where Possible

CMMC 2.0 · 3 controls

AC.L2-3.1.1 Authorized Access Control
IA.L2-3.5.2 Authentication
IA.L2-3.5.3 Multifactor Authentication

ISO 27002:2022 · 3 controls

5.15 Access control
5.17 Authentication information
8.5 Secure authentication

NIST SP 800-161 Rev 1 · 3 controls

161R1-IA-1 Policy and Procedures
161R1-IA-2 Identification and Authentication (Organizational Users)
161R1-IA-8 Identification and Authentication (Non-Organizational Users)

AWS Well-Architected Security Pillar · 2 controls

SEC02-BP01 Use strong sign-in mechanisms
SEC09-BP03 Authenticate network communications

Australia My Health Records Act 2012 · 2 controls

MYHR-REG-11 Ensuring required information is given to the System Operator
MYHR-REG-2 Healthcare recipient registration and identity verification

Azure Security Benchmark · 2 controls

IM-4 Authenticate server and services
IM-6 Use strong authentication controls

C5 (Germany) · 2 controls

C5-IDM-09 Authentication mechanisms
C5-PSS-05 Authentication Mechanisms

ISO 27001:2022 · 2 controls

5.17 Authentication information
8.5 Secure authentication

NIST SP 800-172 · 2 controls

3.5.1e Identification of Systems, Components, and Devices
3.5.3e Prohibit Connection of Unknown or Unverified System Components

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

ASD37-20 Multi-factor authentication (Essential)

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-3 Information Security Category

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-IAM-14 Strong Authentication

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-PR.AA-03 Users, services, and hardware are authenticated

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.