Information Security Handbook

Identification and authentication policy

The identification and authentication policy defines the organization's rules for information system identifiers that are provisioned and managed, as well as the mechanisms allowed for positive authentication of provisioned information system identifiers.

What the identification and authentication policy should address:

• Identifying information system users, processes acting on behalf of users, or devices
• Authenticating (or verifying) the identities of those users, processes, or devices as a prerequisite to allowing access to organizational information systems
• Using multifactor authentication for local and network access to information systems
• Employing replay-resistant authentication mechanisms for ...