Authentication Requirements
Introduction
This document establishes the minimum security requirements to configure how technologies authenticate.
Scope
This policy applies to company-provided systems.
Requirements
To Be Completed
Identities and credentials for authorized users, services, and hardware are managed by Facebook.
Authentication
Users, services, and hardware are authenticated.
Display a system-use notification message with privacy and security notices consistent with applicable rules before granting access to the system.
Prevent access to the system by initiating a device lock after 30 minutes of inactivity.
Terminate a user session automatically after 24 hours of inactivity.
Authenticate all external access to the network using MFA.
The password must be at least 6 characters long.
To Be Completed
Identity assertions are protected, conveyed, and verified.
Limit the number of consecutive invalid login attempts to 15 in 24 hours.
Last updated