8.3.1Strong authentication for users and administrators is established and managed

Defined Approach Requirements:

All user access to system components for users and administrators is authenticated via at least one of the following authentication factors:

- Something you know, such as a password or passphrase.

- Something you have, such as a token device or smart card.

- Something you are, such as a biometric element.

Defined Approach Testing Procedures:

8.3.1.a Examine documentation describing the authentication factor(s) used to verify that user access to system components is authenticated via at least one authentication factor specified in this requirement.

8.3.1.b For each type of authentication factor used with each type of system component, observe an authentication to verify that authentication is functioning consistently with documented authentication factor(s).