IDM-08—Confidentiality of authentication information
>Control Description
The allocation of authentication information to access system components used to provide the cloud service to internal and external users of the cloud provider and system components that are involved in automated authorisation processes of the cloud provider is done in an orderly manner that ensures the confidentiality of the information. If passwords are used as authentication information, their confidentiality is ensured by the following procedures, as far as technically possible:
• Users can initially create the password themselves or must change an initial password when logging on to the system component for the first time. An initial password loses its validity after a maximum of 14 days.
• When creating passwords, compliance with the password specifications (cf. IDM-09) is enforced as far as technically possible.
• The user is informed about changing or resetting the password.
• The server-side storage takes place using cryptographically strong hash functions.
Deviations are evaluated by means of a risk analysis and mitigating measures derived from this are implemented.
Additional criteria: The users sign a declaration in which they assure that they treat personal (or shared) authentication information confidentially and keep it exclusively for themselves (within the members of the group).
Ask AI
Configure your API key to use AI features.