Control Definition
Requires the organization to put authentication technologies and procedures in place that are strong enough for what they protect, with the required strength driven by the sensitivity of the information being accessed and the rules of the access control policy.
Control Objective
To ensure that only authorized users can access systems and data by implementing secure authentication mechanisms that verify user identity.
What This Really Means
Authentication is proving you are who you claim to be before getting access to systems or data. This control requires you to move beyond simple passwords to more secure methods: multi-factor authentication (MFA), biometrics, hardware tokens, or passwordless authentication.
Think of it like entering a high-security building: you don't just say your name at the door—you show an ID badge (something you have), enter a PIN (something you know), and maybe scan your fingerprint (something you are). That's multi-factor authentication in the physical world.
This control demands strong password policies as a baseline (length, complexity, rotation), but more importantly, it requires MFA for accessing sensitive systems, privileged accounts, and remote access. You must also protect authentication credentials in transit (encryption) and at rest (hashing, not plain text storage), and monitor for suspicious authentication attempts like brute force attacks or impossible travel logins.
Why It Matters
Weak authentication is the most common way attackers get in. Year after year, breach reports trace the majority of intrusions back to stolen, weak, or default passwords. Without strong authentication, all your other security controls are worthless—attackers simply walk in the front door.
Without secure authentication mechanisms, organizations face:
- •Credential Theft and Account Takeover – Stolen passwords from phishing or data breaches allow attackers to impersonate legitimate users and access sensitive systems undetected
- •Brute Force and Password Spraying Attacks – Weak passwords can be guessed in minutes using automated tools, especially when MFA isn't enforced
- •Insider Threats and Shared Accounts – Without unique credentials per user, you can't attribute actions to individuals or detect when ex-employees still have access
- •Regulatory Non-Compliance – PCI DSS and RBI master directions explicitly require MFA in scope, and DPDPA and HIPAA demand technical safeguards that weak authentication undermines; failures result in audit findings and potential fines
Indian organizations face additional pressure: CERT-In directions require ICT system logs — authentication logs included — to be retained for 180 days, and the DPDP Act requires reasonable security safeguards for personal data, with authentication as the first gate.
Implementation Guidance
Enforce Multi-Factor Authentication (MFA) Everywhere
Deploy MFA across all critical access points: email (Microsoft 365, Google Workspace), VPN, remote desktop, cloud consoles (AWS, Azure), SaaS applications, and especially privileged accounts. Use authenticator apps (Microsoft/Google Authenticator), hardware tokens (YubiKey), or biometrics. Make MFA mandatory, not optional.
Implement Strong Password Policies with Modern Best Practices
Require minimum 12-character passwords (not just 8). Focus on length over complexity—"correct horse battery staple" beats "P@ssw0rd!". Eliminate forced 90-day rotations (NIST no longer recommends this). Instead, check passwords against breach databases (Have I Been Pwned API), enforce account lockout after 10 failed attempts, and require password changes only when compromised.
Store Passwords Securely Using Industry-Standard Hashing
Never store passwords in plain text or reversible encryption. Use bcrypt, scrypt, or Argon2 with proper salt and work factors. For legacy systems, migrate to modern hashing immediately. Disable password recovery via email—use password reset flows instead. Ensure database backups containing password hashes are encrypted.
Implement Single Sign-On (SSO) with Centralized Identity Management
Deploy SSO using SAML, OAuth 2.0, or OpenID Connect through platforms like Azure AD, Okta, or Auth0. This centralizes authentication, makes MFA enforcement easier, and simplifies access revocation when employees leave. Integrate all SaaS apps and internal systems with SSO. Maintain an application inventory.
Monitor Authentication Events and Detect Anomalies
Log all authentication attempts (successful and failed) with timestamps, source IP, and user details. Send logs to SIEM for analysis. Alert on suspicious patterns: multiple failed logins, impossible travel (login from Mumbai then New York 10 minutes later), access from blacklisted countries, or dormant account suddenly active. Investigate alerts within 24 hours.
Disable or Remove Default and Shared Accounts
Change or disable all default credentials (admin/admin, root/root, sa/<blank>). Eliminate shared accounts like "marketing@company.com" or "sales login"—every user must have unique credentials. For service accounts that must exist, use complex randomly-generated passwords stored in vaults, rotate them quarterly, and restrict their usage to specific IPs/services.
Consider Passwordless Authentication for High-Value Systems
For critical systems, explore passwordless options: Windows Hello for Business, FIDO2 hardware keys, certificate-based authentication, or biometrics. These eliminate password-related risks entirely. Start with privileged users and critical applications, then expand. Maintain backup authentication methods for recovery scenarios.
Audit Evidence
During your ISO 27001 certification audit, auditors will expect to see the following evidence to demonstrate compliance with A.8.5:
Documentation
- Authentication Policy or Access Control Policy defining password requirements and MFA mandates
- MFA implementation documentation showing which systems require multi-factor authentication
- Password policy configuration screenshots from Active Directory, Azure AD, or IAM systems
- SSO integration list showing all applications connected to centralized authentication
- Authentication monitoring reports showing failed login attempts and security incidents
Interviews
- IT Security Manager about authentication standards and MFA enforcement approach
- System administrators about password management and credential storage practices
- Random employees to verify they're using MFA and understand password requirements
Observations
- Attempt to login to critical systems without MFA to verify enforcement
- Review of Active Directory or IAM password policy settings (complexity, length, lockout)
- Check of authentication logs showing monitoring of failed attempts and alerts
- Demonstration of SSO workflow and centralized identity management portal
Practitioner Insights
The most common authentication failure I see in audits: MFA is "enabled" but users can bypass it by clicking "Don't ask again on this device" or using legacy protocols (SMTP, POP3) that don't support MFA. You must block legacy authentication entirely and enforce MFA without bypass options. Test it yourself—if you can get in without the second factor, so can an attacker.
Password complexity requirements like "must have uppercase, lowercase, number, symbol" actually make passwords weaker because users pick predictable patterns like "Password1!" instead of long passphrases. Focus on length (minimum 12 characters), check against breach databases, and enforce MFA. Modern NIST guidelines agree—complexity rules are outdated.
Common Challenges & Solutions
Challenge
Employees resist MFA claiming it's too inconvenient and slows them down.
Solution
Choose user-friendly MFA methods: push notifications (Microsoft/Duo) are faster than typing codes. Enable "remember this device for 30 days" for trusted endpoints. Show executives leading by example. Communicate breach statistics—inconvenience is better than being the next headline. Make it non-negotiable.
Challenge
Legacy applications don't support modern authentication (no MFA, no SSO integration).
Solution
Place legacy apps behind a reverse proxy or VPN that enforces authentication before reaching the app. Use solutions like Azure AD Application Proxy or Cloudflare Access. If the app is truly critical and can't be upgraded, isolate it on a separate network segment with strict access controls. Plan for application modernization or replacement.
Challenge
Users write down MFA backup codes or share them insecurely, defeating the purpose.
Solution
Educate users to store backup codes in password managers (1Password, Bitwarden), not sticky notes. Implement hardware tokens (YubiKey) that can't be written down or shared. Use conditional access policies that trust company-managed devices. Monitor for simultaneous logins from different locations indicating credential sharing.
Challenge
Cloud service accounts and API keys don't have MFA protection, creating a backdoor.
Solution
Use short-lived tokens with automatic rotation (AWS temporary credentials, Azure Managed Identities). Store API keys in secrets management vaults (HashiCorp Vault, AWS Secrets Manager) never in code or config files. Implement IP whitelisting and require certificate-based authentication for service-to-service calls. Scan repositories for accidentally committed credentials.
Challenge
We can't enforce MFA on customers or external users accessing our portal.
Solution
Offer MFA as an opt-in security feature initially while educating users about benefits. For high-value transactions or data access, make MFA mandatory. Use risk-based authentication that requires MFA only for suspicious logins (new device, foreign country). Provide multiple MFA options (SMS, app, email) for flexibility. Gradually increase enforcement.
