Authentication and Authorization

Updates for this SFS are pending because supporting source research is incomplete. Existing catalog content is shown.

This set covers user and service identities, authentication services, federation, directory services, password handling, multifactor authentication, sessions, and role-based access. It also considers account creation, permission review, and timely removal of access. Each question should specify the identities and resources in scope and the evidence needed to show that the access rule is applied. Special handling of administrator and master credentials belongs to SFS 1; authorization across service interfaces is coordinated with SFS C.

• SF 0
• SF 1
• SF 2
• SF 3
• SF 4
• SF 5
• SF 6
• SF 7
• SF 8
• SF 9
• SF A
• SF B
• SF C
• SF D
• SF E
• SF F