Implement mutual TLS + token binding + JWS signing + key management per FAPI 2.0 + national scheme requirements. mTLS for Client Authentication and Token Binding must (a) use certificate-based mutual authentication between AS + Client + (b) bind tokens to client certificate via OAuth 2.0 Mutual TLS Client Authentication and Certificate Bound Access Tokens (RFC 8705), (c) maintain certificate lifecycle including provisioning + renewal + revocation + with directory integration. Request signing with JSON Web Signatures must (a) sign requests per JAR (JWT-Secured Authorization Request) + JARM (JWT Authorization Response Mode) + Pushed Authorization Request, (b) maintain JWKS endpoint + signing key rotation. Key Management for Signing and Encryption must (a) maintain dedicated signing + encryption keys per FAPI 2.0 + national scheme + (b) use HSM where appropriate + (c) implement key rotation + revocation + (d) align with broader cryptographic key management programme. Token Lifetime and Refresh Token Hygiene must (a) maintain short-lived access tokens + (b) implement refresh token rotation + binding + revocation + (c) align with FAPI 2.0 + scheme-specific lifetime requirements.
Maintained by Gerard Blokdyk·Verified against the published standard ·Control text last updated
What else in your programme already covers this
This control maps to 181 controls across 59 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-PR.PS-01 Configuration management practices are established and applied
NIST-CSF-PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33