Implement mutual TLS + token binding + JWS signing + key management per FAPI 2.0 + national scheme requirements. mTLS for Client Authentication and Token Binding must (a) use certificate-based mutual authentication between AS + Client + (b) bind tokens to client certificate via OAuth 2.0 Mutual TLS Client Authentication and Certificate Bound Access Tokens (RFC 8705), (c) maintain certificate lifecycle including provisioning + renewal + revocation + with directory integration. Request signing with JSON Web Signatures must (a) sign requests per JAR (JWT-Secured Authorization Request) + JARM (JWT Authorization Response Mode) + Pushed Authorization Request, (b) maintain JWKS endpoint + signing key rotation. Key Management for Signing and Encryption must (a) maintain dedicated signing + encryption keys per FAPI 2.0 + national scheme + (b) use HSM where appropriate + (c) implement key rotation + revocation + (d) align with broader cryptographic key management programme. Token Lifetime and Refresh Token Hygiene must (a) maintain short-lived access tokens + (b) implement refresh token rotation + binding + revocation + (c) align with FAPI 2.0 + scheme-specific lifetime requirements.
What else in your programme already covers this
This control maps to 202 controls across 70 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-PR.PS-01 Configuration management practices are established and applied
NIST-CSF-PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle