SFS 3: Authentication and Authorization

All 16 sets · What is an SFS?

Assess how identities are verified, accounts are managed, and access permissions are granted, reviewed, and withdrawn.

Scope and boundaries

This set covers user and service identities, authentication services, federation, directory services, password handling, multifactor authentication, sessions, and role-based access. It also considers account creation, permission review, and timely removal of access. Each question should specify the identities and resources in scope and the evidence needed to show that the access rule is applied. Special handling of administrator and master credentials belongs to SFS 1; authorization across service interfaces is coordinated with SFS C.

The sixteen questions

This set has sixteen SF positions, 0–F. Each position is one question, not another set. All questions below are unreviewed placeholders; no assessment result has been recorded.

From questions to a profile

Only reviewed, accepted 0/1 assessments can populate the sixteen-bit set profile. SF 0 is the most significant bit and SF F is the least significant bit. The completed result uses four hexadecimal digits, including leading zeros. There is no completed profile for this draft set.

Read assessment and validation, then encoding. A set profile preserves individual answers; it is not a summed security score.