NIST SP 800-66 Rev 2
Technical

NIST SP 800-66 Rev 2 164.312(d): Person or Entity Authentication (Standard)

Implement procedures to verify that a person or entity seeking access to ePHI is the one claimed. NIST recommends multi-factor authentication and authenticator assurance levels per SP 800-63B.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 74 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 8 controls

  • 10.2.1.1 10.2.1.1 Logs capture individual user access to cardholder data
  • 2.2.2 2.2.2 Vendor default accounts managed
  • 8.2.1 8.2.1 Unique ID assigned to every user
  • 8.3.1 8.3.1 Access authenticated with at least one factor
  • 8.4.1 8.4.1 MFA for non-console administrative CDE access
  • 8.4.2 8.4.2 MFA for all non-console CDE access
  • 9.2.3 9.2.3 Physical protection of network hardware and lines
  • 7.3.1 7.3.1 Need-to-know access control system covers all components

NIST SP 800-53 Rev 5 · 6 controls

CIS Controls v8 · 5 controls

  • CIS-5.2 Use Unique Passwords
  • CIS-6.3 Require MFA for Externally-Exposed Applications
  • CIS-6.4 Require MFA for Remote Network Access
  • CIS-6.5 Require MFA for Administrative Access
  • CIS-6.6 Establish and Maintain an Inventory of Authentication and Authorization Systems

FedRAMP High · 5 controls

  • IA-1 Policy and Procedures
  • IA-2 Identification and Authentication (Organizational Users)
  • IA-2(1) MFA to Privileged Accounts
  • IA-5 Authenticator Management
  • IA-8 Identification and Authentication (Non-Organizational Users)

FedRAMP Moderate · 5 controls

  • IA-1 Policy and Procedures
  • IA-2 Identification and Authentication (Organizational Users)
  • IA-2(1) MFA to Privileged Accounts
  • IA-5 Authenticator Management
  • IA-8 Identification and Authentication (Non-Organizational Users)

UK Cyber Essentials · 5 controls

  • CE-AC.2 Authenticate Users Before Granting Access
  • CE-AC.7 MFA for Administrative Accounts
  • CE-AC.8 Passwordless Authentication
  • CE-SC.4 Authenticate Users Before Access
  • CE-SC.6 Multi-Factor Authentication for Cloud Services

NIST SP 800-171 Rev 3 · 4 controls

SOC 2 · 4 controls

  • SOC2-CC6.1 CC6.1 Logical access security over protected information assets
  • SOC2-CC6.2 CC6.2 Registering and authorising users before issuing credentials
  • SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties
  • SOC2-CC6.6 CC6.6 Protection against threats from outside the system boundary

ACSC Essential Eight · 3 controls

  • E8-MFA-ML1 Multi-Factor Authentication - Maturity Level 1
  • E8-MFA-ML2 Multi-Factor Authentication - Maturity Level 2
  • E8-MFA-ML3 Multi-Factor Authentication - Maturity Level 3

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 3 controls

  • ANSSI-HYG-10 Define and Verify Password Selection and Sizing Rules
  • ANSSI-HYG-12 Change Default Authentication Elements on Equipment and Services
  • ANSSI-HYG-13 Prefer Strong Authentication Where Possible

CMMC 2.0 · 3 controls

ISO 27002:2022 · 3 controls

  • 5.15 Access control
  • 5.17 Authentication information
  • 8.5 Secure authentication

NIST SP 800-161 Rev 1 · 3 controls

  • 161R1-IA-1 Policy and Procedures
  • 161R1-IA-2 Identification and Authentication (Organizational Users)
  • 161R1-IA-8 Identification and Authentication (Non-Organizational Users)

AWS Well-Architected Security Pillar · 2 controls

Australia My Health Records Act 2012 · 2 controls

  • MYHR-REG-11 Ensuring required information is given to the System Operator
  • MYHR-REG-2 Healthcare recipient registration and identity verification

Azure Security Benchmark · 2 controls

  • IM-4 Authenticate server and services
  • IM-6 Use strong authentication controls

C5 (Germany) · 2 controls

ISO 27001:2022 · 2 controls

  • 5.17 Authentication information
  • 8.5 Secure authentication

NIST SP 800-172 · 2 controls

  • 3.5.1e Identification of Systems, Components, and Devices
  • 3.5.3e Prohibit Connection of Unknown or Unverified System Components

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-20 Multi-factor authentication (Essential)

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

NIST Cybersecurity Framework 2.0 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Technical

Query this from an agent

The graph holds this control, the 74 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-66 Rev 2 controls