Skip to main content

💼 PR.AA-03: Users, services, and hardware are authenticated

  • ID: /frameworks/nist-csf-v2.0/pr-aa/03

Stats​

not available

Description​

  1. Require multifactor authentication
  2. Enforce policies for the minimum strength of passwords, PINs, and similar authenticators
  3. Periodically reauthenticate users, services, and hardware based on risk (e.g., in zero trust architectures)
  4. Ensure that authorized personnel can access accounts essential for protecting safety under emergency conditions

Similar​

  • Sections
    • /frameworks/nist-csf-v1.1/pr-ac/03
    • /frameworks/nist-csf-v1.1/pr-ac/07
    • /frameworks/nist-sp-800-53-r5/ac/07
    • /frameworks/nist-sp-800-53-r5/ac/12
    • /frameworks/nist-sp-800-53-r5/ia/02
    • /frameworks/nist-sp-800-53-r5/ia/03
    • /frameworks/nist-sp-800-53-r5/ia/05
    • /frameworks/nist-sp-800-53-r5/ia/07
    • /frameworks/nist-sp-800-53-r5/ia/08
    • /frameworks/nist-sp-800-53-r5/ia/09
    • /frameworks/nist-sp-800-53-r5/ia/10
    • /frameworks/nist-sp-800-53-r5/ia/11

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 NIST CSF v1.1 → 💼 PR.AC-3: Remote access is managed66no data
💼 NIST CSF v1.1 → 💼 PR.AC-7: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals' security and privacy risks and other organizational risks)2428no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-7 Unsuccessful Logon Attempts4no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-12 Session Termination3no data
💼 NIST SP 800-53 Revision 5 → 💼 IA-2 Identification and Authentication (organizational Users)133no data
💼 NIST SP 800-53 Revision 5 → 💼 IA-3 Device Identification and Authentication4no data
💼 NIST SP 800-53 Revision 5 → 💼 IA-5 Authenticator Management1821no data
💼 NIST SP 800-53 Revision 5 → 💼 IA-7 Cryptographic Module Authenticationno data
💼 NIST SP 800-53 Revision 5 → 💼 IA-8 Identification and Authentication (non-organizational Users)6no data
💼 NIST SP 800-53 Revision 5 → 💼 IA-9 Service Identification and Authentication2no data
💼 NIST SP 800-53 Revision 5 → 💼 IA-10 Adaptive Authenticationno data
💼 NIST SP 800-53 Revision 5 → 💼 IA-11 Re-authenticationno data

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance

Policies (102)​

PolicyLogic CountFlagsCompliance
🛡️ AWS Account IAM Password Policy Number of passwords to remember is not set to 24🟢1🟢 x6no data
🛡️ AWS Account Root User credentials were used is the last 30 days🟢1🟢 x6no data
🛡️ AWS EC2 Instance IAM role is not attached🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows public IPv4 (0.0.0.0/0) access to admin ports🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows public IPv6 (::/0) access to admin ports🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted DNS traffic🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted FTP traffic🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted NetBIOS traffic🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted SMTP traffic🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to MongoDB🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to MySQL🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to Oracle DBMS🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to PostgreSQL🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted Telnet traffic🟢1🟢 x6no data
🛡️ AWS IAM Policy allows full administrative privileges🟢1🟢 x6no data
🛡️ AWS IAM Server Certificate is expired🟢1🟢 x6no data
🛡️ AWS IAM User Access Keys are not rotated every 90 days or less🟢1🟢 x6no data
🛡️ AWS IAM User has inline or directly attached policies🟢1🟠 x1, 🟢 x5no data
🛡️ AWS IAM User has more than one active access key🟢1🟢 x6no data
🛡️ AWS IAM User with console and programmatic access set during the initial creation🟢⚪🟢 x2, ⚪ x1no data
🛡️ AWS KMS Symmetric CMK Rotation is not enabled🟢1🟢 x6no data
🛡️ AWS S3 Bucket MFA Delete is not enabled🟠🟢1🟠 x1, 🟢 x6no data
🛡️ Azure App Service Authentication is disabled and Basic Authentication is enabled🟢1🟢 x6no data
🛡️ Azure App Service Basic Authentication is enabled🟢⚪🟢 x2, ⚪ x1no data
🛡️ Azure App Service is not registered with Microsoft Entra ID🟢1🟢 x6no data
🛡️ Azure Key Vault Purge Protection function is not enabled🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to DNS port🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to FTP ports🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to HTTP(S) ports🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to MongoDB ports🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to MySQL port🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to NetBIOS ports🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to Oracle DBMS ports🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to PostgreSQL port🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to SMTP port🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to SSH port🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to Telnet port🟢1🟢 x6no data
🛡️ Azure Non-RBAC Key Vault stores Keys without expiration date🟢1🟢 x6no data
🛡️ Azure Non-RBAC Key Vault stores Secrets without expiration date🟢1🟢 x6no data
🛡️ Azure RBAC Key Vault stores Keys without expiration date🟢1🟢 x6no data
🛡️ Azure RBAC Key Vault stores Secrets without expiration date🟢1🟢 x6no data
🛡️ Azure SQL Database allows ingress from 0.0.0.0/0 (ANY IP)🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to DNS port🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to FTP ports🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to HTTP(S) ports🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to MongoDB ports🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to MySQL port🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to NetBIOS ports🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to Oracle DBMS ports🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to PostgreSQL port🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to SMTP port🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to SSH port🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to Telnet port🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to DNS port🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to FTP ports🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to HTTP(S) ports🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to MongoDB ports🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to MySQL port🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to NetBIOS ports🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to Oracle DBMS ports🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to PostgreSQL port🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to SMTP port🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to SSH port🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to Telnet port🟢1🟢 x6no data
🛡️ Consumer Google Accounts are used🟢⚪🟢 x2, ⚪ x1no data
🛡️ Google Accounts are not configured with MFA🟢⚪🟢 x2, ⚪ x1no data
🛡️ Google BigQuery Dataset is not encrypted with Customer-Managed Encryption Key (CMEK)🟢1🟢 x6no data
🛡️ Google BigQuery Table is not encrypted with Customer-Managed Encryption Key (CMEK)🟢1🟢 x6no data
🛡️ Google Cloud SQL Instance SSL Connections are not enforced🟢1🟢 x6no data
🛡️ Google Dataproc Cluster is not encrypted using Customer-Managed Encryption Key🟢1🟢 x6no data
🛡️ Google GCE Disk for critical VMs is not encrypted with Customer-Supplied Encryption Key (CSEK)🟢1🟢 x6no data
🛡️ Google GCE Firewall Rule logging is disabled🟢1🟢 x6no data
🛡️ Google GCE Instance Block Project-Wide SSH Keys is not enabled🟢1🟢 x6no data
🛡️ Google GCE Instance Confidential Compute is not enabled🟢1🟢 x6no data
🛡️ Google GCE Instance is configured to use the Default Service Account🟢1🟢 x6no data
🛡️ Google GCE Instance is configured to use the Default Service Account with full access to all Cloud APIs🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted CiscoSecure/WebSM traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted DNS traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted FTP traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted HTTP traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted LDAP traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted NetBIOS traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted POP3 traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted SMTP traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted SSH traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to all ports🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to Cassandra🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to Directory services"🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to Elasticsearch🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to Memcached🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to MongoDB🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to MySQL🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to OracleDB🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to PostgreSQL🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to Redis🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted Telnet traffic🟢1🟢 x6no data
🛡️ Google GKE Cluster Network policy is disabled.🟢1🟢 x6no data
🛡️ Oracle IAAS Default Security List allows unrestricted non-ICMP traffic🟢1🟢 x6no data
🛡️ Oracle IAM Auth Tokens are not rotated every 90 days🟢1🟢 x6no data
🛡️ Oracle IAM Customer Secret Keys are not rotated every 90 days🟢1🟢 x6no data
🛡️ Oracle IAM Domain Password Policy has weak complexity requirements🟢1🟢 x6no data
🛡️ Oracle IAM User MFA is disabled🟢1🟢 x6no data