Key takeaways
- Use secure authentication technology and procedures.
- Strong authentication stops most credential-based attacks.
- Start here: require MFA for remote access, email, admin and cloud consoles.
Purpose
Use secure authentication technology and procedures.
Requirement
Requirement summarySecure authentication technologies and procedures shall be implemented based on information access restrictions and the topic-specific policy on access control.
Why it matters
Strong authentication stops most credential-based attacks.
How to implement
- Require MFA for remote access, email, admin and cloud consoles.
- Use single sign-on to centralise authentication.
- Lock or throttle after failed attempts.
- Monitor sign-in logs for anomalies.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.5. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your login rules: multi-factor authentication, account lockout and session timeouts.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.5 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Settings from key systems showing these rules are switched on.
- A list of any exceptions, with approvals.
- Records of locked accounts or failed logins being looked into.
Things you should be able to show or explain
- Be able to show a login to a key system.
How much to show: Three to five key systems.
Common mistakes
- Multi-factor not required for administrators.
- No lockout after repeated failed logins.
- MFA bypass for 'legacy' apps.
- No alerting on suspicious sign-ins.
- Tip: MFA everywhere, phishing-resistant where possible.
Policies & documents to have
- Access Control Policy
FAQ
Is A.8.5 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.5?
Be ready to explain how the control works in your organisation and to provide things like: Your login rules: multi-factor authentication, account lockout and session timeouts…