aws_compliance

AWS Compliance

The identities and the credentials are issued, managed, and verified based on an organizational IAM password policy.

iam_account_password_policy_strong_min_reuse_24

gxp_21_cfr_part_11_11_10_d

11.10(d) Limiting system access to authorized individuals

gxp_21_cfr_part_11_11_10_g

11.10(g) Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand

gxp_21_cfr_part_11_11_200_a

11.200(a) Biometric electronic signature components and controls

gxp_21_cfr_part_11_11_300_b

11.300(b) Ensuring that identification code and password issuances are periodically checked, recalled, or revised (e.g., to cover such events as password aging)

hipaa_final_omnibus_security_rule_2013_164_308_a_4_ii_b

164.308(a)(4)(ii)(B) Access authorization

hipaa_security_rule_2003_164_308_a_4_ii_c

164.308(a)(4)(ii)(C) Access establishment and modification

hipaa_final_omnibus_security_rule_2013_164_308_a_4_ii_c

hipaa_final_omnibus_security_rule_2013_164_308_a_5_ii_d

164.308(a)(5)(ii)(D) Password management

hipaa_security_rule_2003_164_308_a_5_ii_d

hipaa_security_rule_2003_164_312_d

164.312(d) Person or entity authentication

hipaa_final_omnibus_security_rule_2013_164_312_d

rbi_itf_nbfc_3_1_c

3.1.c Role based Access Control

nist_800_171_rev_2_3_5_2

3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems

nist_800_172_3_5_2_e

3.5.2e Employ automated mechanisms for the generation, protection, rotation, and management of passwords for systems and system components that do not support multifactor authentication or complex account management

nist_800_171_rev_2_3_5_5

3.5.5 Prevent reuse of identifiers for a defined period

nist_800_171_rev_2_3_5_6

3.5.6 Disable identifiers after a defined period of inactivity

nist_800_171_rev_2_3_5_7

3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created

nist_800_171_rev_2_3_5_8

3.5.8 Prohibit password reuse for a specified number of generations

nist_800_171_rev_2_3_5_9

3.5.9 Allow temporary password use for system logons with an immediate change to a permanent password

cis_controls_v8_ig1_4_6

4.6 Securely Manage Enterprise Assets and Software

cis_controls_v8_ig1_5_2

5.2 Use Unique Passwords

nydfs_23_500_02_b_2

500.02(b)(2)

nydfs_23_500_07

500.07 Access Privileges and Management

pci_dss_v321_requirement_8_1_4

8.1.4 Observe user accounts to verify that any inactive accounts over 90 days old are either removed or disabled

pci_dss_v321_requirement_8_2

8.2 To verify that users are authenticated using unique ID and additional authentication (for example, a password/phrase) for access to the cardholder data environment perform the methods like examine documentation describing the authentication method(s) used etc

pci_dss_v321_requirement_8_2_3

8.2.3 Passwords/passphrases require a minimum length of at least seven characters, contain both numeric and alphabetic characters

pci_dss_v321_requirement_8_2_3_a

8.2.3.a For a sample of system components, inspect system configuration settings to verify that user password/passphrase parameters are set to require at least the following strength/complexity that is require a minimum length of at least seven characters and contain both numeric and alphabetic characters

pci_dss_v321_requirement_8_2_3_b

8.2.3.b Additional testing procedure for service provider assessments only to review internal processes and customer/user documentation to verify that non-consumer customer passwords/passphrases are required to meet at least the following strength/complexity that is require a minimum length of at least seven characters and contain both numeric and alphabetic characters

pci_dss_v321_requirement_8_2_4

8.2.4 Change user passwords/passphrases at least once every 90 days

pci_dss_v321_requirement_8_2_4_a

8.2.4.a For a sample of system components, inspect system configuration settings to verify that user password/passphrase parameters are set to require users to change passwords at least once every 90 days

pci_dss_v321_requirement_8_2_4_b

8.2.4.b Additional testing procedure for service provider assessments only: Review internal processes and customer/user documentation to verify that non-consumer customer user passwords/passphrases are required to change periodically; and non-consumer customer users are given guidance as to when, and under what circumstances, passwords/passphrases must change

pci_dss_v321_requirement_8_2_5

8.2.5 Do not allow an individual to submit a new password/passphrase that is the same as any of the last four passwords/passphrases he or she has used

pci_dss_v321_requirement_8_2_5_a

8.2.5.a For a sample of system components, obtain and inspect system configuration settings to verify that password parameters are set to require that new passwords/passphrases cannot be the same as the four previously used passwords/passphrases

pci_dss_v321_requirement_8_2_5_b

8.2.5.b Additional testing procedure for service provider assessments only to review internal processes and customer/user documentation to verify that new non-consumer customer user passwords/passphrase cannot be the same as the previous four passwords

rbi_itf_nbfc_8_I

8.I Basic Security Aspects

rbi_itf_nbfc_8_II

8.II User Role

nist_800_53_rev_4_ac_2_1

AC-2(1) Automated System Account Management

nist_800_53_rev_4_ac_2

Account Management (AC-2)

rbi_cyber_security_annex_i_7_2

Annex I (7.2)

article_25

Article 25 Data protection by design and by default

soc_2_cc_6_1

CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives

soc_2_cc_6_2

CC6.2 Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity

ffiec_d_3_pc_am_b_6

D3.PC.Am.B.6

ffiec_d_3_pc_am_b_7

D3.PC.Am.B.7

nist_800_53_rev_4_ia_5_1

IA-5(1) Password-Based Authentication

nist_800_53_rev_4_ia_5_4

IA-5(4) Automated Support For Password Strength Determination

all_controls_iam

nist_800_53_rev_4_ia_2

Identification and Authentication (Organizational users) (IA-2)

nist_csf_pr_ac_1

PR.AC-1

nist_csf_pr_ac_7

PR.AC-7

cisa_cyber_essentials_your_surroundings_4

Your Surroundings-4

cisa_cyber_essentials_your_systems_3

Your Systems-3

IAM password policies for users should have strong configurations

Run individual configuration, compliance and security controls or full compliance benchmarks for CIS, FFIEC, PCI, NIST, HIPAA, RBI CSF, GDPR, SOC 2, Audit Manager Control Tower, FedRAMP, GxP and AWS Foundational Security Best Practices controls across all your AWS accounts using Powerpipe and Steampipe.

Apache License 2.0

steampipe-mod-aws-compliance

Control: IAM password policies for users should have strong configurations

Description

Usage

SQL

Tags