What it asks for. This control expects secure authentication technologies and procedures to be implemented, based on information access restrictions and the topic-specific access control policy. Its purpose is to make sure a user or system is securely authenticated when it is given access to systems, applications and services.
In practice. Good practice means choosing authentication strength according to the sensitivity of the system, with multi-factor authentication for remote access, privileged accounts and important cloud services, and phishing-resistant methods where risk is high. Log-on procedures limit information shown before success, protect against brute force and log failed attempts. Auditors look for authentication standards, configuration evidence in identity providers and coverage reports for multi-factor authentication.
Common gaps. Common gaps are legacy protocols that bypass multi-factor authentication, exceptions for executives or service accounts and applications outside single sign-on.