Requirement

11.6: Authentication

Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.

1. The relevant entities shall implement secure authentication procedures and technologies based on access restrictions and the policy on access control.

2. For that purpose, the relevant entities shall:

ensure the strength of authentication is appropriate to the classification of the asset to be accessed;
control the allocation to users and management of secret authentication information by a process that ensures the confidentiality of the information, including advising personnel on appropriate handling of authentication information;
require the change of authentication credentials initially, at predefined intervals and upon suspicion that the credentials were compromised;
require the reset of authentication credentials and the blocking of users after a predefined number of unsuccessful log-in attempts;
terminate inactive sessions after a predefined period of inactivity; and
require separate credentials to access privileged access or administrative accounts.

3. The relevant entities shall to the extent feasible use state-of-the-art authentication methods, in accordance with the associated assessed risk and the classification of the asset to be accessed, and unique authentication information.

4. The relevant entities shall review the authentication procedures and technologies at planned intervals.

See how Cyberday guides you to fulfill this requirement:

This requirement is part of the framework:

NIS2 Implementing Regulation

Free compliance assessment:

NIS2 Guide

Other requirements of the framework

11.6: Authentication

Best practices

How to implement:

11.6: Authentication

This policy on

11.6: Authentication

provides a set concrete tasks you can complete to secure this topic. Follow these best practices to ensure compliance and strengthen your overall security posture.

1. The relevant entities shall implement secure authentication procedures and technologies based on access restrictions and the policy on access control.

2. For that purpose, the relevant entities shall:

ensure the strength of authentication is appropriate to the classification of the asset to be accessed;
control the allocation to users and management of secret authentication information by a process that ensures the confidentiality of the information, including advising personnel on appropriate handling of authentication information;
require the change of authentication credentials initially, at predefined intervals and upon suspicion that the credentials were compromised;
require the reset of authentication credentials and the blocking of users after a predefined number of unsuccessful log-in attempts;
terminate inactive sessions after a predefined period of inactivity; and
require separate credentials to access privileged access or administrative accounts.

4. The relevant entities shall review the authentication procedures and technologies at planned intervals.

Read below what concrete actions you can take to improve this ->

Frameworks that include requirements for this topic:

No items found.

How to improve security around this topic

In Cyberday, requirements and controls are mapped to universal tasks. A set of tasks in the same topic create a Policy, such as this one.

Here's a list of tasks that help you improve your information and cyber security related to

11.6: Authentication

Task name

Priority

Task completes