8.1.7 Once a user account is locked out, is the lockout Review password procedures duration set to a minimum of 30 minutes or until an Examine system configuration settings administrator enables the user ID? 8.1.8 If a session has been idle for more than 15 minutes, Review password procedures are users required to re-authenticate (for example, Examine system configuration settings the password) to re-activate the terminal or session? 8.2 In addition to assigning a unique ID, is one or more of Review password procedures the following methods employed to authenticate all Observe authentication processes users? Something you know, such as a password or passphrase Something you have, such as a token device or smart card Something you are, such as a biometric 8.2.1 (a) Is strong cryptography used to render all Review password procedures authentication credentials (such as Review vendor documentation passwords/passphrases) unreadable during Examine system configuration settings transmission and storage on all system Observe password components? Observe data transmissions Is user identity verified before modifying any 8.2.2 Review authentication procedures authentication credential (for example, performing Observe personnel password resets, provisioning new tokens, or generating new keys)?
8.1.7 Once a user account is locked out, is the lockout duration set to a minimum of 30 minutes or until an administrator enables the user ID? Review password procedures Examine system configuration settings 8.1.8 If a session has been idle for more than 15 minutes, are users required to re-authenticate (for example, the password) to re-activate the terminal or session? Review password procedures Examine system configuration settings 8.2 In addition to assigning a unique ID, is one or more of the following methods employed to authenticate all users? Something you know, such as a password or passphrase Something you have, such as a token device or smart card Something you are, such as a biometric Review password procedures Observe authentication processes 8.2.1 (a) Is strong cryptography used to render all authentication credentials (such as passwords/passphrases) unreadable during transmission and storage on all system components? Review password procedures Review vendor documentation Examine system configuration settings Observe password Observe data transmissions 8.2.2 Is user identity verified before modifying any authentication credential (for example, performing password resets, provisioning new tokens, or generating new keys)? Review authentication procedures Observe personnel