Discussion
Open question
- Posts
Some products charge extra for single sign-on, or only support MFA for administrators. How should a buyer define this requirement?
Accepted answerBase the requirement on account impact, data sensitivity, privileged access, remote access, and the organization’s identity architecture. Require supported protocols, MFA methods, emergency access, lifecycle provisioning, session controls, logging, and enforcement for every relevant role. Test the controls before acceptance. NIST SP 800-207 states that trust should not depend on network location and that authentication and authorization must occur before access to a resource.
- You must be logged in to reply to this topic.