[Maya Chen]

Some products charge extra for single sign-on, or only support MFA for administrators. How should a buyer define this requirement?

[Priya Shah]

Accepted answer

Base the requirement on account impact, data sensitivity, privileged access, remote access, and the organization’s identity architecture. Require supported protocols, MFA methods, emergency access, lifecycle provisioning, session controls, logging, and enforcement for every relevant role. Test the controls before acceptance. NIST SP 800-207 states that trust should not depend on network location and that authentication and authorization must occur before access to a resource.

[Author]

Posts