143 – Unique access credentials

Summary

System access credentials must be unique for each actor.

Description

Unique credentials must tie specific access and actions to individually identified users. This promotes accountability by determining who performed a particular action or accessed certain data. In cases of unauthorized access or security incidents, unique credentials help identify the responsible user.

Supported In

Advanced: True

References

• CIS-5_2. Use unique passwords
• HIPAA-164_312_a_2_i. Unique user identification (required)
• PADSS-3_1_5. Payment application does not require or use any group, shared, or generic accounts and passwords
• PADSS-10_2_2. Unique authentication credential must be used for each customer environment
• HITRUST-01_q. User identification and authentication
• ISO27002-5_16. Identity management
• ISO27002-7_2. Physical entry controls
• IEC62443-IAC-1_2. Software process and device identification and authentication
• ISSAF-U_9. Web application SQL injections - Bypass user authentication
• NIST800171-5_1. Identify system users, processes acting on behalf of users, and devices
• PCI-8_2_1. Assign a unique ID before access to system components
• SIG-H_2. Access control
• SIG-U_1_9_18. Server security
• ISO27001-5_16. Identity management
• ISO27001-7_2. Physical entry controls
• NIST-PR_AA-01. Identities and credentials for authorized users, services, and hardware are managed by the organization

Last updated

2024/03/05