IA-2(8) Access to Accounts — Replay Resistant
Control enhancement of IA-2 Identification and Authentication (Organizational Users)
Control
Implement replay-resistant authentication mechanisms for access to [Assignment: Selection (one-or-more): privileged accounts | non-privileged accounts].
Discussion
Authentication processes resist replay attacks if it is impractical to achieve successful authentications by replaying previous authentication messages. Replay-resistant techniques include protocols that use nonces or challenges such as time synchronous or cryptographic authenticators.
Need IA-2(8) implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.