{ "schema_version": "obligation_registry_v1", "regulation": "CRA", "regulation_code": "eu_2024_2847", "family": "authentication", "generated_by": "obl_auth_synth/claude-opus-4-8", "synthesis_version": "v1", "citation_status": "pending_span_anchor", "obligations": [ { "id": "user_authentication_required", "name": "Benutzerauthentifizierung vor Zugriff", "description": "Produkte mit digitalen Elementen muessen Nutzer und Entitaeten vor Gewaehrung von Zugriff auf Funktionen, Daten oder geschuetzte Ressourcen authentisieren.", "tier": "LEGAL_MINIMUM", "family": "authentication", "subdomain": "credential", "applicability": "universal", "evidence_facets": { "governance": true, "capability": true, "evidence": true }, "source_role": "LEGAL_BASIS", "legal_basis": [ { "source": "CRA", "regulation_code": "eu_2024_2847", "anchor": "Annex I (2)(d)", "citation": "protect... by ensuring protection from unauthorised access, including by reporting... appropriate control mechanisms incl. authentication, identity or access management" } ], "guidance_basis": [ { "source": "NIST", "anchor": "AC-14", "role": "best_practice" } ], "member_review_units": [ "M3", "M5", "M9", "M21", "M36", "M113", "M118", "M155", "M160" ], "member_controls": [ "ACC-0383-A06", "ACC-0384-A02", "ACC-0384-A03", "ACC-067-A06", "ACC-067-A17", "ACC-082-A06", "ACC-082-A07", "ACC-082-A15", "ACC-082-A16", "ACC-111-A05", "ACC-111-A10", "ACC-320", "ACC-320-A01", "ACC-320-A02", "ACC-320-A03", "ACC-320-A04", "ACC-320-A06", "ACC-320-A09", "ACC-320-A10", "ACC-320-A11", "ACC-320-A12", "ACC-320-A13", "ACC-320-A17", "ACC-320-A19", "ACC-320-A20", "ACC-320-A21", "ACC-320-A26", "ACC-320-A28", "ACC-320-A29", "ACC-320-A35", "ACC-320-A36", "ACC-320-A37", "ACC-320-A38", "ACC-320-A41", "ACC-320-A42", "ACC-320-A43", "ACC-320-A44", "ACC-320-A45", "ACC-327-A18", "ACC-327-A60", "ACC-427", "ACC-427-A01", "ACC-427-A02", "ACC-427-A03", "ACC-427-A11", "ACC-427-A12", "ACC-477-A03", "ACC-478-A02", "ACC-490", "ACC-490-A02", "ACC-490-A04", "ACC-490-A09", "ACC-499-A05", "ACC-504-A09", "ACC-508-A01", "ACC-513", "ACC-518-A06", "ACC-559", "ACC-567-A10", "ACC-571-A05", "ACC-578-A03", "ACC-581-A04", "ACC-586-A03", "ACC-586-A04", "ACC-588-A03", "ACC-594-A10", "ACC-607-A01", "ACC-607-A04", "ACC-630-A05", "ACC-630-A12", "ACC-635", "ACC-635-A01", "ACC-637", "ACC-637-A01", "ACC-641-A06", "ACC-653", "ACC-653-A01", "ACC-657-A02", "ACC-660-A06", "ACC-673-A10", "ACC-727-A03", "ACC-741-A03", "ACL-004", "ACL-004-A03", "ACL-004-A04", "ACL-004-A06", "AI-052-A26", "AI-052-A27", "AI-1012", "AI-1012-A03", "AI-1012-A04", "AI-1012-A05", "AI-1012-A07", "AI-1027-A07", "AI-1236-A04", "AI-1263-A05", "AI-1263-A10", "AI-1392-A06", "AI-1408-A01", "AI-1417-A06", "AI-1660-A12", "AI-1715-A08", "AI-814", "AI-814-A02", "AI-814-A06", "AI-814-A07", "AI-814-A11", "AI-814-A12", "AI-814-A16", "AI-814-A17", "AI-814-A21", "AI-814-A22", "AI-814-A26", "AI-814-A27", "AI-981-A04", "AI-997-A01", "API-001", "ARC-007-A06", "AUTH-018", "AUTH-018-A18", "AUTH-032", "AUTH-043", "AUTH-045", "AUTH-067-A12", "AUTH-098", "AUTH-1001", "AUTH-1002", "AUTH-1003", "AUTH-1003-A01", "AUTH-1004-A01", "AUTH-1008", "AUTH-1009-A01", "AUTH-1009-A03", "AUTH-1011-A01", "AUTH-1019", "AUTH-1026", "AUTH-1026-A01", "AUTH-1048", "AUTH-1048-A03", "AUTH-1048-A04", "AUTH-1048-A19", "AUTH-1048-A68", "AUTH-1048-A69", "AUTH-1049", "AUTH-1060", "AUTH-1061", "AUTH-1087-A01", "AUTH-1087-A04", "AUTH-1092", "AUTH-1092-A04", "AUTH-1099-A04", "AUTH-1102-A08", "AUTH-1110", "AUTH-1110-A03", "AUTH-120-A11", "AUTH-1283", "AUTH-1283-A01", "AUTH-1283-A02", "AUTH-1291", "AUTH-1293", "AUTH-1295-A01", "AUTH-1296-A05", "AUTH-1298-A02", "AUTH-1303-A03", "AUTH-1303-A04", "AUTH-1310-A01", "AUTH-1313-A01", "AUTH-1313-A03", "AUTH-1321-A05", "AUTH-1426-A05", "AUTH-1426-A06", "AUTH-1437", "AUTH-1437-A01", "AUTH-1437-A04", "AUTH-1437-A06", "AUTH-1437-A07", "AUTH-1441", "AUTH-1443-A02", "AUTH-1445-A04", "AUTH-1446", "AUTH-1446-A02", "AUTH-1446-A04", "AUTH-1455", "AUTH-1455-A01", "AUTH-1455-A07", "AUTH-1463-A02", "AUTH-1463-A07", "AUTH-1463-A08", "AUTH-1464-A04", "AUTH-1464-A05", "AUTH-1464-A07", "AUTH-1466-A04", "AUTH-1466-A08", "AUTH-1468", "AUTH-1468-A03", "AUTH-1468-A04", "AUTH-1468-A07", "AUTH-1468-A08", "AUTH-1472-A01", "AUTH-1524", "AUTH-1524-A01", "AUTH-1524-A02", "AUTH-1525-A03", "AUTH-1529", "AUTH-1529-A01", "AUTH-1529-A06", "AUTH-1535-A02", "AUTH-1538-A01", "AUTH-1538-A10", "AUTH-1539-A03", "AUTH-1576-A01", "AUTH-1579-A01", "AUTH-1583-A06", "AUTH-1623-A04", "AUTH-1623-A07", "AUTH-1623-A08", "AUTH-1624-A11", "AUTH-1631", "AUTH-1633-A01", "AUTH-1634-A06", "AUTH-1635-A06", "AUTH-1635-A12", "AUTH-1637-A03", "AUTH-1637-A08", "AUTH-1640-A03", "AUTH-1640-A04", "AUTH-1652-A07", "AUTH-1654", "AUTH-1654-A01", "AUTH-1654-A02", "AUTH-1654-A03", "AUTH-1654-A05", "AUTH-1655-A02", "AUTH-1658-A05", "AUTH-1666-A04", "AUTH-1669-A04", "AUTH-1669-A07", "AUTH-1673-A08", "AUTH-1675-A07", "AUTH-1678-A02", "AUTH-1691", "AUTH-1691-A01", "AUTH-1694-A06", "AUTH-1695", "AUTH-1696-A03", "AUTH-1696-A04", "AUTH-1700-A04", "AUTH-1701-A09", "AUTH-1702-A03", "AUTH-1706-A03", "AUTH-1706-A05", "AUTH-1706-A06", "AUTH-1706-A09", "AUTH-1708", "AUTH-1709-A05", "AUTH-1711-A02", "AUTH-1711-A04", "AUTH-1711-A07", "AUTH-1711-A10", "AUTH-1713", "AUTH-1716", "AUTH-1721-A03", "AUTH-1752-A10", "AUTH-1753-A01", "AUTH-1753-A02", "AUTH-1753-A04", "AUTH-1753-A07", "AUTH-1790-A01", "AUTH-1808-A07", "AUTH-1809", "AUTH-1809-A01", "AUTH-1809-A02", "AUTH-1809-A03", "AUTH-1809-A04", "AUTH-1809-A05", "AUTH-1809-A06", "AUTH-1810", "AUTH-1810-A01", "AUTH-1810-A06", "AUTH-1811", "AUTH-1812", "AUTH-1812-A01", "AUTH-1812-A02", "AUTH-1814-A01", "AUTH-1820-A04", "AUTH-1820-A06", "AUTH-1823", "AUTH-1823-A01", "AUTH-1823-A02", "AUTH-1826-A10", "AUTH-1827-A04", "AUTH-1830-A02", "AUTH-1830-A03", "AUTH-1830-A06", "AUTH-1830-A08", "AUTH-1831-A05", "AUTH-1833-A03", "AUTH-1833-A05", "AUTH-1833-A08", "AUTH-1843-A08", "AUTH-1859", "AUTH-1859-A02", "AUTH-1859-A03", "AUTH-1862-A04", "AUTH-1877", "AUTH-1877-A01", "AUTH-1877-A02", "AUTH-1877-A06", "AUTH-1877-A08", "AUTH-1896-A01", "AUTH-1901", "AUTH-1901-A01", "AUTH-1909", "AUTH-1909-A01", "AUTH-1909-A02", "AUTH-1909-A05", "AUTH-1909-A07", "AUTH-1909-A08", "AUTH-1910-A11", "AUTH-1911-A01", "AUTH-1911-A05", "AUTH-1912-A04", "AUTH-1915-A03", "AUTH-1915-A08", "AUTH-1916-A01", "AUTH-1916-A05", "AUTH-1917-A04", "AUTH-1917-A08", "AUTH-1933", "AUTH-1935", "AUTH-1936-A11", "AUTH-1938", "AUTH-1943", "AUTH-1943-A02", "AUTH-1943-A07", "AUTH-1944", "AUTH-1944-A01", "AUTH-1945-A07", "AUTH-1945-A09", "AUTH-1946-A03", "AUTH-1946-A04", "AUTH-1952", "AUTH-1952-A02", "AUTH-1952-A03", "AUTH-1952-A05", "AUTH-1952-A06", "AUTH-1952-A07", "AUTH-1952-A08", "AUTH-1959", "AUTH-1959-A01", "AUTH-1959-A02", "AUTH-2280", "AUTH-2280-A01", "AUTH-2289", "AUTH-2320", "AUTH-2331-A08", "AUTH-2333-A01", "AUTH-2333-A02", "AUTH-2338-A06", "AUTH-2345-A03", "AUTH-2345-A04", "AUTH-2368-A03", "AUTH-2368-A04", "AUTH-2372-A01", "AUTH-2375", "AUTH-2382-A01", "AUTH-2399", "AUTH-2399-A01", "AUTH-2399-A04", "AUTH-2400-A03", "AUTH-2403", "AUTH-2403-A03", "AUTH-2403-A06", "AUTH-2405", "AUTH-2405-A05", "AUTH-2412-A02", "AUTH-2412-A03", "AUTH-2413-A04", "AUTH-2416-A01", "AUTH-2416-A03", "AUTH-2417", "AUTH-2417-A04", "AUTH-2417-A11", "AUTH-2417-A13", "AUTH-2424-A01", "AUTH-2428", "AUTH-2441-A01", "AUTH-2444-A01", "AUTH-2444-A07", "AUTH-2451-A04", "AUTH-2464-A03", "AUTH-2466-A10", "AUTH-2483-A02", "AUTH-2485-A07", "AUTH-2510-A06", "AUTH-2550-A02", "AUTH-2550-A03", "AUTH-2630", "AUTH-2630-A02", "AUTH-2635", "AUTH-2635-A04", "AUTH-2635-A05", "AUTH-2635-A07", "AUTH-2660-A01", "AUTH-2678", "AUTH-2678-A01", "AUTH-2779", "AUTH-2781-A03", "AUTH-2801", "AUTH-2801-A03", "AUTH-2817", "AUTH-2817-A03", "AUTH-2817-A04", "AUTH-2817-A05", "AUTH-2847", "AUTH-2851", "AUTH-2852", "AUTH-2852-A01", "AUTH-2866", "AUTH-2866-A01", "AUTH-2866-A03", "AUTH-2873-A01", "AUTH-2873-A05", "AUTH-2873-A07", "AUTH-2875-A03", "AUTH-2877-A01", "AUTH-2877-A05", "AUTH-2880-A01", "AUTH-2883", "AUTH-2883-A01", "AUTH-2883-A02", "AUTH-2912-A01", "AUTH-2919", "AUTH-2921-A12", "AUTH-2922-A01", "AUTH-2922-A02", "AUTH-2929", "AUTH-2930", "AUTH-2935-A02", "AUTH-2935-A06", "AUTH-2939-A04", "AUTH-2943", "AUTH-2943-A02", "AUTH-2944-A04", "AUTH-2945-A03", "AUTH-2946", "AUTH-2949-A06", "AUTH-2956-A14", "AUTH-2958-A07", "AUTH-2959-A03", "AUTH-2960-A01", "AUTH-2960-A06", "AUTH-2960-A07", "AUTH-2960-A08", "AUTH-2964", "AUTH-2966-A01", "AUTH-2966-A04", "AUTH-2967-A05", "AUTH-2970-A03", "AUTH-2970-A05", "AUTH-2970-A08", "AUTH-2975-A02", "AUTH-2975-A12", "AUTH-2977-A05", "AUTH-2980", "AUTH-2981-A08", "AUTH-2984", "AUTH-2987-A01", "AUTH-2989-A01", "AUTH-2989-A05", "AUTH-2993-A03", "AUTH-2994-A03", "AUTH-2996-A01", "AUTH-3002-A04", "AUTH-3013-A01", "AUTH-3013-A02", "AUTH-3016-A15", "AUTH-3016-A16", "AUTH-3017-A03", "AUTH-3021-A01", "AUTH-3021-A04", "AUTH-3022-A06", "AUTH-3025", "AUTH-3025-A01", "AUTH-3038", "AUTH-3038-A03", "AUTH-3045", "AUTH-3045-A01", "AUTH-3045-A02", "AUTH-3045-A03", "AUTH-3065-A02", "AUTH-3065-A03", "AUTH-3065-A04", "AUTH-3069", "AUTH-3071-A01", "AUTH-3071-A04", "AUTH-3071-A09", "AUTH-3073", "AUTH-3073-A02", "AUTH-3073-A03", "AUTH-3073-A05", "AUTH-3075-A01", "AUTH-3075-A02", "AUTH-3077", "AUTH-3078", "AUTH-3082", "AUTH-3082-A01", "AUTH-3108-A05", "AUTH-3112-A14", "AUTH-3150", "AUTH-3150-A01", "AUTH-3150-A04", "AUTH-3150-A07", "AUTH-3150-A09", "AUTH-3151", "AUTH-3151-A01", "AUTH-3151-A05", "AUTH-3151-A06", "AUTH-3151-A07", "AUTH-3151-A08", "AUTH-3151-A10", "AUTH-3151-A11", "AUTH-3154", "AUTH-3154-A01", "AUTH-3154-A02", "AUTH-3154-A08", "AUTH-3155", "AUTH-3155-A03", "AUTH-3155-A04", "AUTH-3155-A08", "AUTH-3161-A04", "AUTH-3164-A02", "AUTH-3164-A05", "AUTH-3164-A07", "AUTH-3164-A12", "AUTH-3166-A01", "AUTH-3166-A02", "AUTH-3170", "AUTH-3170-A01", "AUTH-3170-A02", "AUTH-3230-A01", "AUTH-3231-A04", "AUTH-3246-A01", "AUTH-3247-A04", "AUTH-3258", "AUTH-3258-A01", "AUTH-3258-A04", "AUTH-3258-A07", "AUTH-3258-A10", "AUTH-3258-A11", "AUTH-3266", "AUTH-3266-A01", "AUTH-3279-A03", "AUTH-3281-A01", "AUTH-3286-A01", "AUTH-3314-A01", "AUTH-3314-A02", "AUTH-3314-A03", "AUTH-3333-A07", "AUTH-3343", "AUTH-3343-A02", "AUTH-3394-A04", "AUTH-3396-A01", "AUTH-3396-A04", "AUTH-3399", "AUTH-3399-A03", "AUTH-3399-A05", "AUTH-3430-A07", "AUTH-3450", "AUTH-3452-A01", "AUTH-3452-A05", "AUTH-3454-A03", "AUTH-3458-A01", "AUTH-3460-A01", "AUTH-3460-A02", "AUTH-3460-A05", "AUTH-3460-A07", "AUTH-3460-A08", "AUTH-3461-A02", "AUTH-3461-A06", "AUTH-3541-A01", "AUTH-3541-A05", "AUTH-3542-A08", "AUTH-3545-A05", "AUTH-3545-A09", "AUTH-3547-A01", "AUTH-3548-A02", "AUTH-3549", "AUTH-3552", "AUTH-3552-A03", "AUTH-3552-A05", "AUTH-3554", "AUTH-3554-A03", "AUTH-3556-A03", "AUTH-3558", "AUTH-3558-A02", "AUTH-3558-A04", "AUTH-3562", "AUTH-3594-A05", "AUTH-3595-A01", "AUTH-3596-A06", "AUTH-3597", "AUTH-3597-A03", "AUTH-3597-A04", "AUTH-3597-A05", "AUTH-3597-A09", "AUTH-3599-A02", "AUTH-3599-A05", "AUTH-3624", "AUTH-3624-A01", "AUTH-3624-A02", "AUTH-3641", "AUTH-3641-A01", "AUTH-3641-A08", "AUTH-3645-A05", "AUTH-3645-A06", "AUTH-3648-A06", "AUTH-3656-A09", "AUTH-3656-A12", "AUTH-3656-A13", "AUTH-3677-A06", "AUTH-3704-A06", "AUTH-3705", "AUTH-3705-A01", "AUTH-3751-A01", "AUTH-3825-A01", "AUTH-3825-A06", "AUTH-384", "AUTH-384-A05", "AUTH-384-A07", "AUTH-384-A10", "AUTH-3887-A07", "AUTH-3906", "AUTH-3915-A03", "AUTH-3922", "AUTH-3923-A02", "AUTH-3935", "AUTH-3935-A10", "AUTH-3935-A11", "AUTH-3935-A12", "AUTH-3935-A13", "AUTH-3935-A14", "AUTH-3935-A15", "AUTH-3935-A16", "AUTH-3935-A17", "AUTH-3935-A18", "AUTH-3935-A19", "AUTH-3946-A03", "AUTH-3946-A06", "AUTH-3947-A06", "AUTH-3951-A06", "AUTH-3951-A07", "AUTH-3955-A01", "AUTH-3958", "AUTH-3960-A02", "AUTH-3960-A03", "AUTH-3960-A04", "AUTH-3962-A01", "AUTH-3964-A06", "AUTH-3968-A07", "AUTH-3977-A03", "AUTH-3984-A04", "AUTH-3993-A01", "AUTH-3993-A03", "AUTH-3997", "AUTH-3997-A02", "AUTH-3999-A02", "AUTH-4007", "AUTH-4027-A03", "AUTH-4030-A06", "AUTH-4031-A06", "AUTH-4032-A08", "AUTH-4035", "AUTH-4035-A05", "AUTH-4035-A06", "AUTH-4043-A08", "AUTH-4048", "AUTH-4053", "AUTH-4054-A02", "AUTH-4054-A04", "AUTH-4054-A07", "AUTH-4072-A06", "AUTH-4076-A01", "AUTH-4082-A01", "AUTH-4095-A01", "AUTH-4130", "AUTH-4130-A01", "AUTH-4133-A01", "AUTH-4135", "AUTH-451-A02", "AUTH-474", "AUTH-474-A02", "AUTH-497", "AUTH-497-A03", "AUTH-500-A03", "AUTH-505-A04", "AUTH-520", "AUTH-520-A01", "AUTH-524-A08", "AUTH-530-A01", "AUTH-530-A05", "AUTH-530-A08", "AUTH-530-A11", "AUTH-532", "AUTH-538-A06", "AUTH-548", "AUTH-548-A01", "AUTH-548-A03", "AUTH-559", "AUTH-559-A01", "AUTH-559-A03", "AUTH-559-A05", "AUTH-559-A09", "AUTH-559-A12", "AUTH-577", "AUTH-577-A05", "AUTH-582", "AUTH-582-A01", "AUTH-584", "AUTH-584-A01", "AUTH-584-A02", "AUTH-584-A08", "AUTH-584-A09", "AUTH-585", "AUTH-585-A03", "AUTH-592", "AUTH-592-A02", "AUTH-595", "AUTH-595-A05", "AUTH-595-A07", "AUTH-610", "AUTH-610-A06", "AUTH-615", "AUTH-615-A01", "AUTH-615-A02", "AUTH-615-A03", "AUTH-615-A04", "AUTH-615-A05", "AUTH-616", "AUTH-616-A01", "AUTH-616-A02", "AUTH-616-A03", "AUTH-616-A05", "AUTH-616-A06", "AUTH-616-A12", "AUTH-616-A13", "AUTH-617", "AUTH-621-A08", "AUTH-621-A16", "AUTH-623", "AUTH-623-A01", "AUTH-623-A02", "AUTH-623-A03", "AUTH-623-A04", "AUTH-623-A05", "AUTH-623-A06", "AUTH-637-A08", "AUTH-637-A09", "AUTH-637-A30", "AUTH-646-A04", "AUTH-655-A10", "AUTH-655-A11", "AUTH-659", "AUTH-659-A01", "AUTH-661-A06", "AUTH-661-A15", "AUTH-670-A06", "AUTH-694", "AUTH-694-A02", "AUTH-694-A03", "AUTH-700-A02", "AUTH-710-A03", "AUTH-710-A04", "AUTH-710-A05", "AUTH-725-A03", "AUTH-727", "AUTH-730-A03", "AUTH-730-A12", "AUTH-732", "AUTH-732-A04", "AUTH-732-A05", "AUTH-732-A06", "AUTH-732-A07", "AUTH-732-A08", "AUTH-734", "AUTH-734-A01", "AUTH-734-A11", "AUTH-745", "AUTH-745-A01", "AUTH-748-A05", "AUTH-748-A06", "AUTH-748-A10", "AUTH-748-A11", "AUTH-752", "AUTH-752-A01", "AUTH-752-A07", "AUTH-774", "AUTH-775-A10", "AUTH-784", "AUTH-784-A02", "AUTH-784-A03", "AUTH-784-A07", "AUTH-785-A01", "AUTH-803-A01", "AUTH-803-A05", "AUTH-803-A06", "AUTH-803-A07", "AUTH-803-A08", "AUTH-804-A06", "AUTH-807", "AUTH-807-A01", "AUTH-818-A02", "AUTH-822-A04", "AUTH-822-A05", "AUTH-822-A07", "AUTH-822-A09", "AUTH-825-A05", "AUTH-827-A05", "AUTH-827-A06", "AUTH-827-A09", "AUTH-827-A14", "AUTH-828-A05", "AUTH-828-A09", "AUTH-828-A10", "AUTH-836-A04", "AUTH-836-A05", "AUTH-836-A07", "AUTH-836-A11", "AUTH-836-A16", "AUTH-837-A06", "AUTH-837-A13", "AUTH-838-A10", "AUTH-838-A17", "AUTH-838-A26", "AUTH-838-A36", "AUTH-838-A44", "AUTH-844-A03", "AUTH-844-A12", "AUTH-844-A20", "AUTH-844-A27", "AUTH-844-A36", "AUTH-845", "AUTH-845-A01", "AUTH-845-A13", "AUTH-845-A24", "AUTH-845-A27", "AUTH-845-A45", "AUTH-846", "AUTH-846-A01", "AUTH-846-A02", "AUTH-846-A03", "AUTH-846-A10", "AUTH-846-A11", "AUTH-846-A12", "AUTH-846-A20", "AUTH-846-A21", "AUTH-846-A22", "AUTH-846-A30", "AUTH-846-A31", "AUTH-846-A32", "AUTH-846-A39", "AUTH-846-A40", "AUTH-846-A41", "AUTH-849", "AUTH-849-A10", "AUTH-849-A17", "AUTH-849-A23", "AUTH-849-A34", "AUTH-849-A40", "AUTH-849-A49", "AUTH-849-A55", "AUTH-851-A01", "AUTH-851-A02", "AUTH-851-A46", "AUTH-885-A03", "AUTH-885-A10", "AUTH-885-A17", "AUTH-885-A22", "AUTH-885-A31", "AUTH-888-A03", "AUTH-888-A10", "AUTH-888-A17", "AUTH-888-A25", "AUTH-888-A30", "AUTH-888-A33", "AUTH-888-A37", "AUTH-894", "AUTH-894-A06", "AUTH-894-A11", "AUTH-894-A12", "AUTH-894-A17", "AUTH-894-A22", "AUTH-902-A01", "AUTH-902-A11", "AUTH-902-A17", "AUTH-903-A23", "AUTH-905-A04", "AUTH-905-A09", "AUTH-905-A14", "AUTH-905-A17", "AUTH-905-A22", "AUTH-909-A02", "AUTH-909-A12", "AUTH-909-A22", "AUTH-909-A32", "AUTH-909-A42", "AUTH-913-A05", "AUTH-914", "AUTH-915", "AUTH-915-A07", "AUTH-915-A13", "AUTH-915-A14", "AUTH-917", "AUTH-917-A01", "AUTH-917-A04", "AUTH-917-A05", "AUTH-917-A06", "AUTH-917-A09", "AUTH-917-A10", "AUTH-917-A11", "AUTH-917-A14", "AUTH-917-A15", "AUTH-917-A16", "AUTH-917-A17", "AUTH-917-A20", "AUTH-917-A21", "AUTH-917-A22", "AUTH-917-A24", "AUTH-917-A25", "AUTH-917-A26", "AUTH-919-A01", "AUTH-919-A07", "AUTH-922-A02", "AUTH-922-A08", "AUTH-928-A07", "AUTH-928-A13", "AUTH-928-A19", "AUTH-928-A25", "AUTH-928-A30", "AUTH-932", "AUTH-937-A01", "AUTH-937-A08", "AUTH-937-A15", "AUTH-937-A22", "AUTH-937-A29", "AUTH-938-A01", "AUTH-938-A02", "AUTH-938-A03", "AUTH-938-A08", "AUTH-938-A09", "AUTH-938-A10", "AUTH-938-A13", "AUTH-938-A14", "AUTH-938-A19", "AUTH-938-A20", "AUTH-938-A21", "AUTH-938-A26", "AUTH-938-A27", "AUTH-938-A28", "AUTH-938-A36", "AUTH-938-A37", "AUTH-938-A38", "AUTH-941", "AUTH-941-A04", "AUTH-941-A05", "AUTH-941-A10", "AUTH-941-A11", "AUTH-941-A14", "AUTH-941-A17", "AUTH-941-A18", "AUTH-941-A23", "AUTH-941-A24", "AUTH-942-A13", "AUTH-948", "AUTH-949-A18", "AUTH-954-A15", "AUTH-974-A07", "AUTH-988-A09", "AUTH-988-A20", "AUTH-989-A18", "COMP-001-A41", "COMP-001-A83", "COMP-1079-A02", "COMP-1079-A10", "COMP-1264-A01", "COMP-1264-A02", "COMP-1264-A05", "COMP-1812-A02", "COMP-1817", "COMP-1883-A01", "COMP-1883-A03", "COMP-1904-A01", "COMP-1904-A04", "COMP-1904-A05", "COMP-1951-A03", "COMP-1960-A06", "COMP-1960-A09", "COMP-2012-A02", "COMP-2029-A04", "COMP-2131-A09", "COMP-2182-A02", "COMP-2627-A08", "COMP-2639-A04", "COMP-2652-A02", "COMP-3435-A01", "COMP-3435-A05", "COMP-3602", "COMP-3602-A01", "COMP-3602-A08", "COMP-3602-A10", "COMP-3733-A03", "COMP-3739-A09", "COMP-3981", "COMP-3983-A02", "COMP-3983-A04", "COMP-3983-A05", "COMP-3983-A09", "COMP-3983-A10", "COMP-3983-A11", "COMP-3983-A14", "CRYP-1017-A01", "CRYP-1097-A09", "CRYP-1103-A11", "CRYP-1124-A05", "CRYP-1134", "CRYP-1252-A02", "CRYP-1255-A01", "CRYP-1305-A03", "CRYP-1306-A07", "CRYP-1385-A02", "CRYP-1386-A08", "CRYP-1391-A05", "CRYP-1393-A03", "CRYP-1421-A03", "CRYP-1466-A03", "CRYP-1466-A05", "CRYP-1525-A06", "CRYP-1652-A10", "CRYP-1684-A01", "CRYP-1694-A01", "CRYP-1712-A15", "CRYP-1725-A07", "CRYP-1750-A14", "CRYP-1756-A05", "CRYP-1788-A03", "CRYP-1819-A02", "CRYP-1864", "CRYP-1864-A02", "CRYP-1864-A03", "CRYP-190-A12", "CRYP-190-A13", "CRYP-1968-A15", "CRYP-1983-A01", "CRYP-2094-A03", "CRYP-2142-A02", "CRYP-2144-A02", "CRYP-2192-A03", "CRYP-2192-A06", "CRYP-2287-A12", "CRYP-2294-A09", "CRYP-335-A03", "CRYP-425-A02", "CRYP-447-A16", "CRYP-450-A05", "CRYP-450-A06", "CRYP-450-A40", "CRYP-450-A52", "CRYP-450-A53", "CRYP-626", "CRYP-655-A01", "CRYP-655-A07", "CRYP-671-A08", "CRYP-749-A05", "CRYP-773-A02", "CRYP-809-A02", "CRYP-822-A03", "CRYP-868-A02", "CRYP-952-A08", "DATA-014-A01", "DATA-1136-A06", "DATA-1161-A02", "DATA-1191-A10", "DATA-1207-A03", "DATA-1257-A05", "DATA-1257-A09", "DATA-1701-A05", "DATA-1801-A06", "DATA-1881-A01", "DATA-2057-A21", "DATA-2119-A01", "DATA-2427-A01", "DATA-2533-A01", "DATA-2558-A03", "DATA-260-A02", "DATA-260-A08", "DATA-2607-A05", "DATA-2648-A01", "DATA-2668-A01", "DATA-3292-A01", "DATA-3324-A05", "DATA-3401-A01", "DATA-3613-A01", "DATA-3649-A09", "DATA-3692-A04", "DATA-3754-A03", "DATA-4203-A05", "DATA-4294-A13", "DATA-879-A03", "DATA-972-A06", "DATA-972-A12", "FIN-1094-A03", "FIN-1223-A06", "FIN-1223-A10", "FIN-606-A06", "FIN-852", "FIN-852-A04", "FIN-891-A08", "GIA-002-A02", "GIA-002-A06", "GOV-0661-A15", "GOV-1435-A08", "GOV-1562-A05", "GOV-1605-A01", "GOV-1611-A04", "GOV-1648-A01", "GOV-1648-A02", "GOV-1700-A01", "GOV-1732-A01", "GOV-1733-A04", "GOV-3072-A05", "GOV-3501-A02", "GOV-3860-A09", "GOV-3860-A10", "GOV-3871", "GOV-3902-A01", "GOV-3909-A01", "GOV-3909-A02", "GOV-413-A18", "GOV-519", "GOV-519-A11", "GOV-519-A35", "GOV-520-A40", "GOV-877-A05", "HLT-524-A04", "HLT-532-A06", "HLT-559-A03", "IAM-008", "IDA-005", "IDA-008-A01", "IDA-008-A04", "IDF-004-A02", "IDF-010", "IDF-010-A01", "INC-071-A14", "INC-1142-A03", "INC-946-A06", "LAB-246-A08", "LGM-001-A09", "LOG-053-A07", "LOG-1086-A03", "LOG-1087-A03", "LOG-1087-A11", "LOG-121-A04", "LOG-121-A17", "LOG-1549-A05", "LOG-1549-A08", "LOG-1742-A05", "LOG-1742-A08", "LOG-1742-A13", "LOG-1748-A01", "LOG-1767-A02", "LOG-1859", "LOG-1859-A04", "LOG-1859-A10", "LOG-705-A01", "LOG-735-A17", "LOG-735-A18", "LOG-745-A44", "LOG-745-A54", "LOG-774-A01", "LOG-774-A15", "LOG-774-A22", "LOG-774-A29", "MIA-001", "NET-076-A07", "NET-076-A14", "NET-1014-A03", "NET-1014-A07", "NET-1249-A05", "NET-1274-A01", "NET-1277-A01", "NET-1303-A01", "NET-1309-A02", "NET-1464-A05", "NET-1466-A04", "NET-1476-A09", "NET-1633", "NET-1633-A01", "NET-1669-A02", "NET-1669-A07", "NET-1683-A06", "NET-1787-A11", "NET-1855-A01", "NET-1856-A10", "NET-1858-A08", "NET-351", "NET-351-A01", "NET-351-A02", "NET-351-A06", "NET-351-A07", "NET-391", "NET-391-A01", "NET-391-A08", "NET-405", "NET-405-A03", "NET-405-A08", "NET-405-A09", "NET-465-A02", "NET-465-A07", "NET-506-A15", "NET-506-A60", "NET-527-A04", "NET-527-A15", "NET-527-A23", "NET-794-A06", "NET-825-A03", "NET-855-A05", "NET-857-A01", "NET-857-A02", "NET-857-A04", "NET-857-A05", "NET-860-A01", "NET-860-A02", "NET-867-A02", "NET-928-A02", "NET-965-A03", "NET-980-A07", "NET-981-A10", "NET-982-A02", "PFI-001-A02", "PRC-012-A01", "SEC-008-A13", "SEC-082-A06", "SEC-1144-A03", "SEC-1144-A28", "SEC-1144-A42", "SEC-1144-A56", "SEC-1144-A70", "SEC-1146-A02", "SEC-1146-A07", "SEC-1146-A54", "SEC-1146-A59", "SEC-1153-A12", "SEC-1215-A05", "SEC-1221-A10", "SEC-2007-A02", "SEC-2635-A03", "SEC-2635-A04", "SEC-2643-A07", "SEC-2662-A07", "SEC-2662-A13", "SEC-2698-A01", "SEC-2738-A02", "SEC-2788-A06", "SEC-2818-A05", "SEC-2845-A09", "SEC-2899", "SEC-2899-A04", "SEC-2899-A05", "SEC-2899-A06", "SEC-2927-A04", "SEC-3065-A02", "SEC-3157-A07", "SEC-3159-A05", "SEC-3195-A04", "SEC-3217-A03", "SEC-3383-A08", "SEC-3709-A10", "SEC-3732-A08", "SEC-3872-A01", "SEC-3931-A02", "SEC-3931-A10", "SEC-3935-A02", "SEC-4010-A09", "SEC-4217", "SEC-4254-A03", "SEC-4414-A04", "SEC-4513", "SEC-4513-A04", "SEC-4560", "SEC-4561", "SEC-4561-A01", "SEC-4561-A02", "SEC-4561-A03", "SEC-4561-A07", "SEC-4655-A03", "SEC-4655-A04", "SEC-5505-A02", "SEC-5595-A13", "SEC-5610-A03", "SEC-5615", "SEC-5792-A02", "SEC-5792-A03", "SEC-5858-A07", "SEC-5880-A03", "SEC-6093-A01", "SEC-6153-A10", "SEC-6170-A02", "SEC-6296", "SEC-6724-A05", "SEC-6770", "SEC-6771-A04", "SEC-6784-A10", "SEC-6830-A05", "SEC-6919-A03", "SEC-6956-A06", "SEC-7022-A04", "SEC-7108-A03", "SEC-7229-A09", "SEC-7237-A02", "SEC-7343-A03", "SEC-7398-A03", "SEC-7442-A04", "SEC-7963-A02", "SEC-7967", "SEC-7993-A02", "SEC-7994", "SEC-7994-A06", "SEC-8016", "SEC-8041-A07", "SEC-8121-A05", "SEC-8138-A03", "SEC-8155-A02", "SEC-8257-A02", "SEC-9014-A16", "SEC-9136-A08", "SEC-9175", "SEC-9212-A01", "SEC-9212-A02" ], "member_count": 1339, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.95, "source_meta_cluster": "M5", "cluster_size": 339, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" }, "evidence_merged_from": [ "auth_testing" ] }, { "id": "authentication_policy_documented", "name": "Authentifizierungsrichtlinie dokumentieren", "description": "Eine Authentifizierungs- und Autorisierungsrichtlinie ist zu dokumentieren, zu versionieren und aktuell zu halten.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "credential", "applicability": "universal", "evidence_facets": { "governance": true, "capability": false, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "ISO", "anchor": "ISO 27001 A.5.17", "role": "best_practice" }, { "source": "Warnungen bei unsicheren Authentifizierungsmethoden", "anchor": "", "role": "implementation_guidance", "merged_from": "weak_method_warnings" } ], "member_review_units": [ "M3", "M35", "M40", "M116" ], "member_controls": [ "ACC-0383-A06", "ACC-0384-A02", "ACC-0384-A03", "ACC-082-A06", "ACC-082-A07", "ACC-082-A15", "ACC-082-A16", "ACC-320", "ACC-320-A01", "ACC-320-A02", "ACC-320-A03", "ACC-320-A04", "ACC-320-A06", "ACC-320-A09", "ACC-320-A10", "ACC-320-A11", "ACC-320-A12", "ACC-320-A13", "ACC-320-A17", "ACC-320-A19", "ACC-320-A20", "ACC-320-A21", "ACC-320-A26", "ACC-320-A28", "ACC-320-A29", "ACC-320-A35", "ACC-320-A36", "ACC-320-A37", "ACC-320-A41", "ACC-320-A43", "ACC-320-A44", "ACC-320-A45", "ACC-327-A18", "ACC-327-A60", "ACC-427", "ACC-427-A01", "ACC-427-A11", "ACC-518-A06", "ACC-567-A10", "ACC-568-A05", "ACC-571-A09", "ACC-741-A03", "ACC-741-A05", "ACC-754-A05", "ACL-004-A04", "AI-052-A26", "AI-052-A27", "AI-1027-A07", "AI-1311-A05", "AI-1311-A09", "AI-1417-A06", "AI-1715-A08", "AUTH-013-A09", "AUTH-014", "AUTH-014-A18", "AUTH-014-A25", "AUTH-014-A26", "AUTH-032", "AUTH-043", "AUTH-045", "AUTH-067-A12", "AUTH-088-A01", "AUTH-088-A02", "AUTH-088-A07", "AUTH-1004-A01", "AUTH-1009-A01", "AUTH-1009-A03", "AUTH-1011-A01", "AUTH-1011-A11", "AUTH-1011-A13", "AUTH-1026", "AUTH-1026-A01", "AUTH-1088-A01", "AUTH-1088-A04", "AUTH-1095-A01", "AUTH-1095-A04", "AUTH-1096-A04", "AUTH-1101-A01", "AUTH-1101-A06", "AUTH-1110-A03", "AUTH-1276", "AUTH-1282", "AUTH-1283-A02", "AUTH-1283-A03", "AUTH-1283-A04", "AUTH-1283-A05", "AUTH-1295-A02", "AUTH-1295-A05", "AUTH-1298", "AUTH-1298-A01", "AUTH-1298-A02", "AUTH-1298-A03", "AUTH-1310-A04", "AUTH-1311-A02", "AUTH-1313-A01", "AUTH-1313-A02", "AUTH-1314-A04", "AUTH-1426-A05", "AUTH-1437", "AUTH-1437-A01", "AUTH-1437-A02", "AUTH-1437-A06", "AUTH-1448-A01", "AUTH-1455-A02", "AUTH-1463-A02", "AUTH-1480", "AUTH-1480-A01", "AUTH-1519-A02", "AUTH-1524-A03", "AUTH-1529-A06", "AUTH-1535-A04", "AUTH-1576-A01", "AUTH-1579-A01", "AUTH-1579-A02", "AUTH-1623-A03", "AUTH-1623-A04", "AUTH-1623-A07", "AUTH-1623-A08", "AUTH-1624-A11", "AUTH-1627", "AUTH-1634", "AUTH-1634-A01", "AUTH-1637-A09", "AUTH-1640-A03", "AUTH-1645-A04", "AUTH-1646", "AUTH-1669-A01", "AUTH-1677-A02", "AUTH-1677-A08", "AUTH-1678-A07", "AUTH-1693", "AUTH-1693-A01", "AUTH-1694-A06", "AUTH-1711-A02", "AUTH-1711-A08", "AUTH-1711-A09", "AUTH-1711-A10", "AUTH-1716-A02", "AUTH-1716-A03", "AUTH-1720-A05", "AUTH-1721-A01", "AUTH-1721-A03", "AUTH-1734-A02", "AUTH-1746", "AUTH-1746-A01", "AUTH-1747-A01", "AUTH-1753-A05", "AUTH-1810-A01", "AUTH-1812-A02", "AUTH-1812-A05", "AUTH-1814-A01", "AUTH-1814-A02", "AUTH-1818-A06", "AUTH-1835-A04", "AUTH-1835-A08", "AUTH-1837", "AUTH-1837-A02", "AUTH-1839-A05", "AUTH-1843-A07", "AUTH-1843-A09", "AUTH-1844-A04", "AUTH-1858", "AUTH-1859", "AUTH-1859-A04", "AUTH-1859-A05", "AUTH-1859-A07", "AUTH-1864-A02", "AUTH-1864-A04", "AUTH-1864-A05", "AUTH-1864-A06", "AUTH-1864-A07", "AUTH-1864-A08", "AUTH-1877-A05", "AUTH-1877-A08", "AUTH-1877-A11", "AUTH-1901-A02", "AUTH-1908-A02", "AUTH-1908-A04", "AUTH-1909-A02", "AUTH-1909-A06", "AUTH-1909-A07", "AUTH-1909-A08", "AUTH-1910-A09", "AUTH-1913", "AUTH-1915", "AUTH-1915-A01", "AUTH-1917-A04", "AUTH-1917-A08", "AUTH-1938-A04", "AUTH-1943-A04", "AUTH-1947-A07", "AUTH-1952-A05", "AUTH-1952-A06", "AUTH-1952-A08", "AUTH-1959", "AUTH-1959-A02", "AUTH-1959-A04", "AUTH-1959-A06", "AUTH-1959-A08", "AUTH-2280", "AUTH-2280-A01", "AUTH-2317-A02", "AUTH-2333-A01", "AUTH-2333-A02", "AUTH-2338-A06", "AUTH-2368-A03", "AUTH-2368-A08", "AUTH-2371", "AUTH-2371-A03", "AUTH-2371-A05", "AUTH-2372-A01", "AUTH-2375-A05", "AUTH-2382-A01", "AUTH-2399", "AUTH-2399-A04", "AUTH-2400-A07", "AUTH-2403", "AUTH-2403-A02", "AUTH-2403-A06", "AUTH-2405-A05", "AUTH-2413-A05", "AUTH-2413-A06", "AUTH-2416", "AUTH-2416-A01", "AUTH-2416-A03", "AUTH-2416-A05", "AUTH-2416-A07", "AUTH-2416-A08", "AUTH-2417-A06", "AUTH-2417-A07", "AUTH-2417-A11", "AUTH-2417-A13", "AUTH-2420", "AUTH-2423", "AUTH-2423-A04", "AUTH-2430-A01", "AUTH-2438", "AUTH-2438-A03", "AUTH-2441-A06", "AUTH-2444-A01", "AUTH-2444-A07", "AUTH-2451-A04", "AUTH-2464-A03", "AUTH-2466-A04", "AUTH-2466-A12", "AUTH-2543-A04", "AUTH-2573-A03", "AUTH-2678-A04", "AUTH-2678-A05", "AUTH-2678-A06", "AUTH-2678-A07", "AUTH-2689-A07", "AUTH-2779", "AUTH-2781-A07", "AUTH-2793-A01", "AUTH-2801", "AUTH-2817", "AUTH-2817-A01", "AUTH-2847-A15", "AUTH-2850-A04", "AUTH-2851", "AUTH-2851-A09", "AUTH-2852", "AUTH-2873-A01", "AUTH-2873-A05", "AUTH-2873-A06", "AUTH-2875-A02", "AUTH-2875-A05", "AUTH-2877-A01", "AUTH-2877-A05", "AUTH-2880-A01", "AUTH-2880-A08", "AUTH-2886-A05", "AUTH-2889-A05", "AUTH-2906-A01", "AUTH-2906-A08", "AUTH-2913-A13", "AUTH-2921", "AUTH-2943-A08", "AUTH-2945", "AUTH-2949-A09", "AUTH-2956", "AUTH-2959-A03", "AUTH-2960-A08", "AUTH-2970-A02", "AUTH-2970-A07", "AUTH-2970-A09", "AUTH-2975", "AUTH-2977-A06", "AUTH-2981-A01", "AUTH-2987-A06", "AUTH-2989-A01", "AUTH-2995", "AUTH-3008-A02", "AUTH-3016-A14", "AUTH-3017-A07", "AUTH-3018-A05", "AUTH-3045", "AUTH-3045-A01", "AUTH-3045-A02", "AUTH-3045-A03", "AUTH-3064-A04", "AUTH-3065-A03", "AUTH-3065-A04", "AUTH-3068", "AUTH-3068-A01", "AUTH-3068-A02", "AUTH-3068-A03", "AUTH-3068-A04", "AUTH-3068-A05", "AUTH-3070-A03", "AUTH-3071-A01", "AUTH-3071-A03", "AUTH-3071-A04", "AUTH-3071-A09", "AUTH-3073-A01", "AUTH-3073-A05", "AUTH-3074-A03", "AUTH-3074-A04", "AUTH-3075-A01", "AUTH-3150-A03", "AUTH-3150-A04", "AUTH-3150-A05", "AUTH-3150-A06", "AUTH-3150-A09", "AUTH-3151", "AUTH-3151-A01", "AUTH-3151-A07", "AUTH-3151-A10", "AUTH-3151-A12", "AUTH-3154-A02", "AUTH-3154-A06", "AUTH-3155-A04", "AUTH-3161-A04", "AUTH-3164-A02", "AUTH-3164-A05", "AUTH-3164-A07", "AUTH-3164-A12", "AUTH-3166-A01", "AUTH-3166-A02", "AUTH-3170", "AUTH-3170-A01", "AUTH-3170-A02", "AUTH-3230-A01", "AUTH-3255-A02", "AUTH-3258-A02", "AUTH-3258-A12", "AUTH-3279-A03", "AUTH-3284", "AUTH-3284-A03", "AUTH-3300-A10", "AUTH-3305", "AUTH-3305-A05", "AUTH-3314-A01", "AUTH-3314-A02", "AUTH-3314-A03", "AUTH-3394-A02", "AUTH-3394-A04", "AUTH-3396-A02", "AUTH-3396-A04", "AUTH-3425-A03", "AUTH-3428-A01", "AUTH-3430-A01", "AUTH-3430-A06", "AUTH-3430-A12", "AUTH-3460-A02", "AUTH-3460-A03", "AUTH-3461-A02", "AUTH-3461-A04", "AUTH-3461-A06", "AUTH-3541-A03", "AUTH-3541-A05", "AUTH-3541-A08", "AUTH-3548-A01", "AUTH-3550-A01", "AUTH-3550-A02", "AUTH-3554-A01", "AUTH-3554-A05", "AUTH-3556-A03", "AUTH-3558-A04", "AUTH-3562-A03", "AUTH-3594-A08", "AUTH-3595-A11", "AUTH-3596-A06", "AUTH-3597", "AUTH-3597-A01", "AUTH-3597-A04", "AUTH-3597-A05", "AUTH-3597-A08", "AUTH-3624", "AUTH-3624-A01", "AUTH-3624-A02", "AUTH-3633-A07", "AUTH-3633-A10", "AUTH-3634-A05", "AUTH-3641-A05", "AUTH-3652-A08", "AUTH-3656-A05", "AUTH-3656-A06", "AUTH-3656-A08", "AUTH-3677-A06", "AUTH-3705-A10", "AUTH-3712", "AUTH-3751-A04", "AUTH-384-A06", "AUTH-3865-A07", "AUTH-3887-A07", "AUTH-3900-A04", "AUTH-3904", "AUTH-3904-A01", "AUTH-3904-A02", "AUTH-3904-A04", "AUTH-3908-A02", "AUTH-3908-A03", "AUTH-3922", "AUTH-3935-A16", "AUTH-3946-A04", "AUTH-3951-A01", "AUTH-3951-A02", "AUTH-3951-A03", "AUTH-3951-A04", "AUTH-3951-A05", "AUTH-3951-A06", "AUTH-3951-A07", "AUTH-3951-A09", "AUTH-3955-A07", "AUTH-3958-A01", "AUTH-3958-A03", "AUTH-3958-A06", "AUTH-3960-A01", "AUTH-3960-A04", "AUTH-3960-A05", "AUTH-3963-A05", "AUTH-3963-A06", "AUTH-3964", "AUTH-3964-A01", "AUTH-3964-A02", "AUTH-3964-A03", "AUTH-3964-A04", "AUTH-3964-A05", "AUTH-3964-A06", "AUTH-3968-A02", "AUTH-3968-A04", "AUTH-3984-A02", "AUTH-3987", "AUTH-3987-A02", "AUTH-3999-A01", "AUTH-4004", "AUTH-4007-A06", "AUTH-4031-A01", "AUTH-4031-A07", "AUTH-4032-A11", "AUTH-4036-A01", "AUTH-4036-A05", "AUTH-4043", "AUTH-4043-A06", "AUTH-4050", "AUTH-4054-A07", "AUTH-4054-A08", "AUTH-4121-A02", "AUTH-4130-A03", "AUTH-4135-A03", "AUTH-474-A07", "AUTH-497", "AUTH-497-A03", "AUTH-505-A04", "AUTH-509-A05", "AUTH-509-A06", "AUTH-530-A01", "AUTH-530-A05", "AUTH-530-A08", "AUTH-530-A11", "AUTH-559", "AUTH-559-A01", "AUTH-559-A03", "AUTH-559-A05", "AUTH-559-A16", "AUTH-582", "AUTH-582-A01", "AUTH-584", "AUTH-584-A01", "AUTH-584-A02", "AUTH-584-A08", "AUTH-584-A09", "AUTH-592-A05", "AUTH-592-A06", "AUTH-595", "AUTH-595-A05", "AUTH-610", "AUTH-610-A06", "AUTH-615", "AUTH-615-A01", "AUTH-615-A02", "AUTH-615-A03", "AUTH-615-A04", "AUTH-615-A05", "AUTH-616", "AUTH-616-A01", "AUTH-616-A02", "AUTH-616-A03", "AUTH-616-A05", "AUTH-616-A06", "AUTH-616-A12", "AUTH-616-A13", "AUTH-616-A15", "AUTH-616-A16", "AUTH-617", "AUTH-623", "AUTH-623-A01", "AUTH-623-A02", "AUTH-623-A03", "AUTH-623-A04", "AUTH-623-A05", "AUTH-623-A06", "AUTH-637-A08", "AUTH-637-A09", "AUTH-637-A30", "AUTH-665", "AUTH-670", "AUTH-694", "AUTH-694-A03", "AUTH-694-A06", "AUTH-710-A05", "AUTH-718", "AUTH-732-A04", "AUTH-732-A05", "AUTH-745", "AUTH-745-A01", "AUTH-745-A04", "AUTH-745-A05", "AUTH-748-A05", "AUTH-748-A06", "AUTH-748-A10", "AUTH-748-A11", "AUTH-751", "AUTH-752", "AUTH-752-A01", "AUTH-752-A07", "AUTH-784-A01", "AUTH-784-A03", "AUTH-789-A03", "AUTH-803-A07", "AUTH-804-A06", "AUTH-818-A02", "AUTH-818-A08", "AUTH-818-A14", "AUTH-822-A04", "AUTH-822-A05", "AUTH-825-A05", "AUTH-831", "AUTH-836-A04", "AUTH-836-A11", "AUTH-838-A11", "AUTH-838-A18", "AUTH-838-A27", "AUTH-838-A37", "AUTH-838-A45", "AUTH-845-A01", "AUTH-845-A13", "AUTH-845-A24", "AUTH-845-A27", "AUTH-845-A45", "AUTH-846-A03", "AUTH-846-A12", "AUTH-846-A22", "AUTH-846-A32", "AUTH-846-A41", "AUTH-850", "AUTH-857-A03", "AUTH-885-A03", "AUTH-885-A10", "AUTH-885-A17", "AUTH-885-A22", "AUTH-885-A25", "AUTH-885-A31", "AUTH-885-A34", "AUTH-889", "AUTH-894-A06", "AUTH-894-A11", "AUTH-894-A12", "AUTH-902-A01", "AUTH-902-A11", "AUTH-902-A17", "AUTH-906-A01", "AUTH-906-A06", "AUTH-906-A11", "AUTH-906-A15", "AUTH-906-A20", "AUTH-906-A21", "AUTH-909-A02", "AUTH-909-A12", "AUTH-909-A22", "AUTH-909-A32", "AUTH-909-A42", "AUTH-917", "AUTH-917-A01", "AUTH-917-A04", "AUTH-917-A05", "AUTH-917-A06", "AUTH-917-A09", "AUTH-917-A10", "AUTH-917-A11", "AUTH-917-A14", "AUTH-917-A15", "AUTH-917-A17", "AUTH-917-A20", "AUTH-917-A21", "AUTH-917-A22", "AUTH-917-A24", "AUTH-917-A25", "AUTH-917-A26", "AUTH-919", "AUTH-922-A02", "AUTH-922-A08", "AUTH-925-A13", "AUTH-926", "AUTH-932", "AUTH-932-A02", "AUTH-932-A07", "AUTH-932-A12", "AUTH-932-A18", "AUTH-932-A23", "AUTH-937-A01", "AUTH-937-A08", "AUTH-937-A15", "AUTH-937-A22", "AUTH-937-A29", "AUTH-939-A12", "AUTH-939-A29", "AUTH-954-A15", "AUTH-960", "AUTH-974-A07", "AUTH-987", "AUTH-987-A01", "AUTH-987-A23", "AUTH-987-A24", "COMP-1264", "COMP-1264-A01", "COMP-1264-A02", "COMP-1264-A05", "COMP-1652-A07", "COMP-1745-A03", "COMP-1817-A04", "COMP-2060-A01", "COMP-2131-A09", "COMP-262-A01", "COMP-2639-A04", "COMP-2755-A01", "COMP-2768-A02", "COMP-2876-A05", "COMP-3476-A04", "COMP-3602", "COMP-3602-A01", "COMP-3602-A06", "COMP-3602-A08", "COMP-3602-A10", "COMP-3733-A08", "COMP-3739-A06", "COMP-3739-A07", "COMP-3978-A01", "COMP-3978-A02", "COMP-3981-A06", "COMP-3983", "COMP-3983-A02", "COMP-3983-A07", "COMP-3983-A12", "COMP-3983-A13", "CRYP-1089-A02", "CRYP-1134-A05", "CRYP-1159-A02", "CRYP-1214-A04", "CRYP-1255-A04", "CRYP-1255-A05", "CRYP-1386-A08", "CRYP-1421-A05", "CRYP-1431-A02", "CRYP-1466-A03", "CRYP-1473-A07", "CRYP-1475-A06", "CRYP-1520-A04", "CRYP-1533-A05", "CRYP-1712-A01", "CRYP-1712-A05", "CRYP-172-A07", "CRYP-1732-A01", "CRYP-1751-A10", "CRYP-1751-A11", "CRYP-1788-A11", "CRYP-1864", "CRYP-1864-A02", "CRYP-1927-A12", "CRYP-1942-A10", "CRYP-1983-A01", "CRYP-2101-A02", "CRYP-2173-A01", "CRYP-2287-A01", "CRYP-2308-A04", "CRYP-2363-A05", "CRYP-450-A05", "CRYP-450-A06", "CRYP-450-A40", "CRYP-450-A52", "CRYP-450-A53", "CRYP-626", "CRYP-726-A08", "CRYP-738-A05", "CRYP-773-A09", "CRYP-873-A01", "CRYP-873-A10", "CRYP-880-A04", "CRYP-927-A11", "CRYP-961-A10", "DATA-1191-A10", "DATA-1240-A08", "DATA-1257-A09", "DATA-1499-A03", "DATA-1801-A06", "DATA-1801-A09", "DATA-1881-A07", "DATA-2427-A06", "DATA-2572", "DATA-260-A02", "DATA-260-A08", "DATA-2607-A02", "DATA-2607-A03", "DATA-2607-A05", "DATA-2648-A01", "DATA-2663-A04", "DATA-3292-A01", "DATA-3324-A11", "DATA-3401-A01", "DATA-3649-A14", "DATA-4027-A02", "DATA-4225-A03", "DATA-972-A06", "DATA-972-A12", "FIN-1223-A06", "GOV-1561-A04", "GOV-180-A18", "GOV-2396-A07", "GOV-2718-A03", "GOV-3502-A08", "GOV-413-A18", "GOV-519", "GOV-520-A40", "INC-946-A11", "LOG-1059-A01", "LOG-1737-A01", "MIA-001", "NET-004-A05", "NET-004-A09", "NET-004-A19", "NET-1012-A03", "NET-1012-A06", "NET-1014-A03", "NET-1014-A04", "NET-104-A02", "NET-104-A10", "NET-1277-A06", "NET-1293-A07", "NET-1309-A01", "NET-1343-A05", "NET-149-A01", "NET-149-A11", "NET-1856-A05", "NET-351", "NET-351-A01", "NET-351-A02", "NET-351-A06", "NET-351-A07", "NET-351-A10", "NET-391", "NET-391-A01", "NET-391-A08", "NET-405", "NET-405-A03", "NET-405-A08", "NET-405-A09", "NET-859-A05", "NET-859-A06", "NET-860-A03", "NET-860-A04", "NET-860-A08", "PFI-001-A02", "SEC-1085", "SEC-1144-A03", "SEC-1144-A28", "SEC-1144-A42", "SEC-1144-A56", "SEC-1144-A70", "SEC-1146-A02", "SEC-1146-A07", "SEC-1146-A54", "SEC-1146-A59", "SEC-1153-A12", "SEC-171-A16", "SEC-171-A34", "SEC-2035-A04", "SEC-2153-A03", "SEC-2176-A03", "SEC-2635-A03", "SEC-2786-A04", "SEC-2809-A04", "SEC-2818-A04", "SEC-2818-A05", "SEC-2853-A05", "SEC-2895-A06", "SEC-3175-A11", "SEC-3223", "SEC-3643-A08", "SEC-3709-A07", "SEC-3853", "SEC-3857-A05", "SEC-3857-A08", "SEC-3895-A01", "SEC-3991", "SEC-4090-A05", "SEC-4292-A04", "SEC-4561-A04", "SEC-4593-A05", "SEC-4655", "SEC-4655-A01", "SEC-4655-A02", "SEC-4655-A04", "SEC-4655-A05", "SEC-5595-A09", "SEC-5596-A02", "SEC-5610-A02", "SEC-5767", "SEC-5780", "SEC-5792-A03", "SEC-5792-A04", "SEC-6770", "SEC-6784-A06", "SEC-6830-A05", "SEC-7442-A06", "SEC-8016-A03", "SEC-8016-A09", "SEC-8138-A03", "SEC-8257-A10", "SEC-8325", "SEC-9212-A02" ], "member_count": 842, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.85, "source_meta_cluster": "M3", "cluster_size": 376, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" }, "evidence_merged_from": [ "auth_inventory", "auth_suitability_assessment", "auth_risk_assessment" ] }, { "id": "auth_exceptions_documented", "name": "Ausnahmen von Authentifizierungspflicht dokumentieren", "description": "Erlaubte Aktionen ohne Identifikation/Authentifizierung sowie Ausnahmen sind explizit zu dokumentieren und zu begruenden.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "credential", "applicability": "universal", "evidence_facets": { "governance": true, "capability": false, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "NIST", "anchor": "AC-14", "role": "best_practice" } ], "member_review_units": [ "M3", "M1", "M6", "M107" ], "member_controls": [ "ACC-001-A14", "ACC-001-A17", "ACC-001-A29", "ACC-0383-A06", "ACC-0384-A02", "ACC-0384-A03", "ACC-0410-A03", "ACC-082-A06", "ACC-082-A07", "ACC-082-A08", "ACC-082-A09", "ACC-082-A15", "ACC-082-A16", "ACC-082-A17", "ACC-082-A18", "ACC-320", "ACC-320-A01", "ACC-320-A02", "ACC-320-A03", "ACC-320-A04", "ACC-320-A06", "ACC-320-A09", "ACC-320-A10", "ACC-320-A11", "ACC-320-A12", "ACC-320-A13", "ACC-320-A16", "ACC-320-A17", "ACC-320-A18", "ACC-320-A19", "ACC-320-A20", "ACC-320-A21", "ACC-320-A24", "ACC-320-A26", "ACC-320-A28", "ACC-320-A29", "ACC-320-A34", "ACC-320-A35", "ACC-320-A36", "ACC-320-A37", "ACC-320-A38", "ACC-320-A40", "ACC-320-A41", "ACC-320-A42", "ACC-320-A43", "ACC-320-A44", "ACC-320-A45", "ACC-320-A48", "ACC-327-A18", "ACC-327-A60", "ACC-427", "ACC-427-A01", "ACC-427-A02", "ACC-427-A03", "ACC-427-A11", "ACC-427-A12", "ACC-478-A08", "ACC-490-A04", "ACC-490-A09", "ACC-499-A05", "ACC-499-A07", "ACC-504-A09", "ACC-508-A06", "ACC-518-A06", "ACC-559-A04", "ACC-567-A10", "ACC-578-A07", "ACC-607", "ACC-673-A10", "ACC-741-A03", "ACL-004-A04", "AI-052-A26", "AI-052-A27", "AI-052-A28", "AI-052-A29", "AI-1012-A03", "AI-1012-A04", "AI-1012-A05", "AI-1012-A07", "AI-1027-A07", "AI-1236-A04", "AI-1408-A01", "AI-1417-A06", "AI-1660-A12", "AI-1715-A08", "AI-797-A09", "AI-797-A18", "AI-797-A36", "AI-797-A45", "AI-924-A13", "AI-924-A14", "AI-997-A01", "AUTH-008-A25", "AUTH-018", "AUTH-018-A18", "AUTH-032", "AUTH-043", "AUTH-045", "AUTH-067-A12", "AUTH-1004-A01", "AUTH-1008", "AUTH-1009-A01", "AUTH-1009-A03", "AUTH-1011-A01", "AUTH-1026", "AUTH-1026-A01", "AUTH-1048-A03", "AUTH-1048-A69", "AUTH-1049-A56", "AUTH-1050-A13", "AUTH-1061-A75", "AUTH-1084", "AUTH-1087-A04", "AUTH-1095-A02", "AUTH-1096", "AUTH-1096-A01", "AUTH-1102-A08", "AUTH-1102-A14", "AUTH-1110-A03", "AUTH-112-A04", "AUTH-112-A17", "AUTH-1283-A02", "AUTH-1288", "AUTH-1293", "AUTH-1296-A05", "AUTH-1298-A02", "AUTH-1300-A05", "AUTH-1303-A03", "AUTH-1313-A01", "AUTH-1313-A04", "AUTH-1314-A03", "AUTH-1426-A05", "AUTH-1426-A06", "AUTH-1437", "AUTH-1437-A01", "AUTH-1437-A06", "AUTH-1445-A02", "AUTH-1445-A04", "AUTH-1455", "AUTH-1455-A01", "AUTH-1455-A07", "AUTH-1463-A02", "AUTH-1463-A04", "AUTH-1463-A09", "AUTH-1464-A04", "AUTH-1464-A05", "AUTH-1464-A07", "AUTH-1466-A04", "AUTH-1466-A09", "AUTH-1468-A01", "AUTH-1468-A06", "AUTH-1524", "AUTH-1524-A01", "AUTH-1524-A02", "AUTH-1524-A04", "AUTH-1529-A04", "AUTH-1529-A06", "AUTH-1535-A02", "AUTH-1538-A01", "AUTH-1538-A10", "AUTH-1576-A01", "AUTH-1579-A01", "AUTH-1623-A04", "AUTH-1623-A07", "AUTH-1623-A08", "AUTH-1624-A11", "AUTH-1633-A01", "AUTH-1634-A06", "AUTH-1635-A06", "AUTH-1640-A03", "AUTH-1652-A07", "AUTH-1654", "AUTH-1654-A01", "AUTH-1654-A02", "AUTH-1654-A03", "AUTH-1654-A05", "AUTH-1669-A05", "AUTH-1669-A06", "AUTH-1669-A07", "AUTH-1675-A07", "AUTH-1678-A02", "AUTH-1679", "AUTH-1679-A02", "AUTH-1694-A06", "AUTH-1695", "AUTH-1702-A03", "AUTH-1706-A05", "AUTH-1706-A09", "AUTH-1709-A05", "AUTH-1711-A02", "AUTH-1711-A04", "AUTH-1711-A06", "AUTH-1711-A07", "AUTH-1711-A10", "AUTH-1721-A03", "AUTH-1742-A01", "AUTH-1742-A07", "AUTH-1752-A10", "AUTH-1759-A05", "AUTH-1790", "AUTH-1809", "AUTH-1809-A02", "AUTH-1809-A06", "AUTH-1810-A01", "AUTH-1812", "AUTH-1812-A01", "AUTH-1812-A02", "AUTH-1814-A01", "AUTH-1818-A11", "AUTH-1820-A06", "AUTH-1823", "AUTH-1823-A01", "AUTH-1823-A02", "AUTH-1827-A04", "AUTH-1831-A05", "AUTH-1859", "AUTH-1860-A05", "AUTH-1860-A08", "AUTH-1860-A09", "AUTH-1862-A09", "AUTH-1865-A12", "AUTH-187-A11", "AUTH-1877-A08", "AUTH-1909-A02", "AUTH-1909-A07", "AUTH-1909-A08", "AUTH-1910-A05", "AUTH-1910-A11", "AUTH-1912-A07", "AUTH-1917-A04", "AUTH-1917-A08", "AUTH-1936-A11", "AUTH-1940-A04", "AUTH-1952", "AUTH-1952-A02", "AUTH-1952-A03", "AUTH-1952-A05", "AUTH-1952-A06", "AUTH-1952-A07", "AUTH-1952-A08", "AUTH-1959", "AUTH-1959-A02", "AUTH-2121-A04", "AUTH-2280", "AUTH-2280-A01", "AUTH-2315-A04", "AUTH-2331-A08", "AUTH-2333-A01", "AUTH-2333-A02", "AUTH-2338-A06", "AUTH-2338-A09", "AUTH-2345-A03", "AUTH-2345-A04", "AUTH-2368-A03", "AUTH-2372-A01", "AUTH-2382-A01", "AUTH-2399", "AUTH-2399-A04", "AUTH-2399-A07", "AUTH-2403", "AUTH-2403-A03", "AUTH-2403-A06", "AUTH-2405-A05", "AUTH-2405-A06", "AUTH-2416-A01", "AUTH-2416-A03", "AUTH-2417-A04", "AUTH-2417-A11", "AUTH-2417-A13", "AUTH-2444-A01", "AUTH-2444-A07", "AUTH-2451-A04", "AUTH-2464-A03", "AUTH-2678", "AUTH-2678-A01", "AUTH-2779", "AUTH-2793", "AUTH-2793-A02", "AUTH-2801", "AUTH-2805-A06", "AUTH-2805-A11", "AUTH-2817", "AUTH-2850", "AUTH-2851", "AUTH-2851-A10", "AUTH-2852", "AUTH-2873-A01", "AUTH-2873-A05", "AUTH-2877-A01", "AUTH-2877-A05", "AUTH-2879", "AUTH-2880-A01", "AUTH-2883", "AUTH-2883-A01", "AUTH-2883-A02", "AUTH-2921-A12", "AUTH-2935-A06", "AUTH-2939-A04", "AUTH-2959-A03", "AUTH-2960-A08", "AUTH-2967-A05", "AUTH-2979-A07", "AUTH-2980", "AUTH-2989-A01", "AUTH-2993-A03", "AUTH-3004", "AUTH-3013-A02", "AUTH-3045", "AUTH-3045-A01", "AUTH-3045-A02", "AUTH-3045-A03", "AUTH-3045-A04", "AUTH-3065-A02", "AUTH-3065-A03", "AUTH-3065-A04", "AUTH-3068-A06", "AUTH-3071-A01", "AUTH-3071-A04", "AUTH-3071-A09", "AUTH-3073", "AUTH-3073-A02", "AUTH-3073-A03", "AUTH-3073-A05", "AUTH-3075-A01", "AUTH-3075-A02", "AUTH-3075-A03", "AUTH-3075-A05", "AUTH-3082-A10", "AUTH-3150", "AUTH-3150-A01", "AUTH-3150-A04", "AUTH-3150-A07", "AUTH-3150-A09", "AUTH-3151", "AUTH-3151-A01", "AUTH-3151-A05", "AUTH-3151-A07", "AUTH-3151-A09", "AUTH-3151-A10", "AUTH-3154", "AUTH-3154-A01", "AUTH-3154-A02", "AUTH-3154-A08", "AUTH-3155", "AUTH-3155-A04", "AUTH-3161-A04", "AUTH-3164-A02", "AUTH-3164-A05", "AUTH-3164-A07", "AUTH-3164-A12", "AUTH-3166-A01", "AUTH-3166-A02", "AUTH-3170", "AUTH-3170-A01", "AUTH-3170-A02", "AUTH-3230-A01", "AUTH-3266-A07", "AUTH-3279-A03", "AUTH-3314-A01", "AUTH-3314-A02", "AUTH-3314-A03", "AUTH-3394-A04", "AUTH-3396-A04", "AUTH-3399", "AUTH-3399-A03", "AUTH-3460-A02", "AUTH-3460-A04", "AUTH-3460-A08", "AUTH-3461-A02", "AUTH-3461-A03", "AUTH-3461-A05", "AUTH-3461-A06", "AUTH-3486-A10", "AUTH-3541-A05", "AUTH-3541-A06", "AUTH-3542-A06", "AUTH-3547-A01", "AUTH-3548-A02", "AUTH-3549", "AUTH-3552-A05", "AUTH-3554-A02", "AUTH-3554-A03", "AUTH-3556-A03", "AUTH-3558-A04", "AUTH-3595", "AUTH-3595-A06", "AUTH-3595-A08", "AUTH-3596", "AUTH-3596-A04", "AUTH-3596-A06", "AUTH-3597", "AUTH-3597-A03", "AUTH-3597-A04", "AUTH-3597-A05", "AUTH-3597-A06", "AUTH-3599-A02", "AUTH-3599-A04", "AUTH-3624", "AUTH-3624-A01", "AUTH-3624-A02", "AUTH-3638", "AUTH-3641", "AUTH-3677-A06", "AUTH-3751-A08", "AUTH-3825-A01", "AUTH-3825-A06", "AUTH-384-A07", "AUTH-384-A10", "AUTH-3887-A07", "AUTH-3922", "AUTH-3935", "AUTH-3935-A10", "AUTH-3935-A11", "AUTH-3935-A12", "AUTH-3935-A13", "AUTH-3935-A14", "AUTH-3935-A15", "AUTH-3935-A16", "AUTH-3935-A17", "AUTH-3935-A18", "AUTH-3935-A19", "AUTH-3948-A04", "AUTH-3951-A06", "AUTH-3951-A07", "AUTH-3955-A01", "AUTH-3958-A02", "AUTH-3960-A02", "AUTH-3960-A03", "AUTH-3960-A04", "AUTH-3964-A06", "AUTH-3964-A07", "AUTH-3993", "AUTH-3993-A01", "AUTH-3993-A02", "AUTH-3993-A03", "AUTH-4027-A02", "AUTH-4030-A03", "AUTH-4031-A08", "AUTH-4032-A02", "AUTH-4036-A04", "AUTH-4043-A08", "AUTH-4054-A07", "AUTH-4085", "AUTH-4085-A01", "AUTH-4095-A17", "AUTH-4135", "AUTH-494-A02", "AUTH-497", "AUTH-497-A03", "AUTH-505-A04", "AUTH-505-A06", "AUTH-530-A01", "AUTH-530-A05", "AUTH-530-A08", "AUTH-530-A11", "AUTH-548", "AUTH-548-A01", "AUTH-548-A03", "AUTH-559", "AUTH-559-A01", "AUTH-559-A03", "AUTH-559-A04", "AUTH-559-A05", "AUTH-559-A09", "AUTH-559-A12", "AUTH-559-A13", "AUTH-559-A14", "AUTH-559-A15", "AUTH-577", "AUTH-577-A05", "AUTH-582", "AUTH-582-A01", "AUTH-584", "AUTH-584-A01", "AUTH-584-A02", "AUTH-584-A06", "AUTH-584-A08", "AUTH-584-A09", "AUTH-592", "AUTH-592-A02", "AUTH-595", "AUTH-595-A05", "AUTH-610", "AUTH-610-A06", "AUTH-615", "AUTH-615-A01", "AUTH-615-A02", "AUTH-615-A03", "AUTH-615-A04", "AUTH-615-A05", "AUTH-615-A06", "AUTH-616", "AUTH-616-A01", "AUTH-616-A02", "AUTH-616-A03", "AUTH-616-A05", "AUTH-616-A06", "AUTH-616-A12", "AUTH-616-A13", "AUTH-617", "AUTH-623", "AUTH-623-A01", "AUTH-623-A02", "AUTH-623-A03", "AUTH-623-A04", "AUTH-623-A05", "AUTH-623-A06", "AUTH-623-A07", "AUTH-623-A08", "AUTH-637-A08", "AUTH-637-A09", "AUTH-637-A30", "AUTH-646-A04", "AUTH-655-A10", "AUTH-655-A11", "AUTH-694", "AUTH-694-A02", "AUTH-694-A03", "AUTH-700-A02", "AUTH-710-A04", "AUTH-710-A05", "AUTH-710-A06", "AUTH-732-A01", "AUTH-732-A04", "AUTH-732-A05", "AUTH-743-A04", "AUTH-743-A10", "AUTH-745", "AUTH-745-A01", "AUTH-748-A05", "AUTH-748-A06", "AUTH-748-A10", "AUTH-748-A11", "AUTH-751-A05", "AUTH-751-A06", "AUTH-751-A07", "AUTH-751-A08", "AUTH-752", "AUTH-752-A01", "AUTH-752-A07", "AUTH-762-A11", "AUTH-774-A01", "AUTH-775-A10", "AUTH-784-A03", "AUTH-784-A08", "AUTH-784-A09", "AUTH-785-A01", "AUTH-803-A05", "AUTH-803-A07", "AUTH-804-A05", "AUTH-804-A06", "AUTH-818-A02", "AUTH-822-A04", "AUTH-822-A05", "AUTH-822-A06", "AUTH-822-A08", "AUTH-824-A15", "AUTH-825-A05", "AUTH-828-A05", "AUTH-828-A09", "AUTH-828-A10", "AUTH-836", "AUTH-836-A01", "AUTH-836-A02", "AUTH-836-A04", "AUTH-836-A05", "AUTH-836-A06", "AUTH-836-A07", "AUTH-836-A08", "AUTH-836-A09", "AUTH-836-A11", "AUTH-836-A12", "AUTH-836-A17", "AUTH-836-A18", "AUTH-837-A07", "AUTH-838-A10", "AUTH-838-A17", "AUTH-838-A26", "AUTH-838-A36", "AUTH-838-A44", "AUTH-845-A01", "AUTH-845-A07", "AUTH-845-A13", "AUTH-845-A19", "AUTH-845-A24", "AUTH-845-A27", "AUTH-845-A29", "AUTH-845-A39", "AUTH-845-A45", "AUTH-845-A55", "AUTH-846-A03", "AUTH-846-A09", "AUTH-846-A12", "AUTH-846-A19", "AUTH-846-A22", "AUTH-846-A29", "AUTH-846-A32", "AUTH-846-A38", "AUTH-846-A41", "AUTH-846-A48", "AUTH-849-A26", "AUTH-849-A27", "AUTH-849-A31", "AUTH-849-A32", "AUTH-849-A43", "AUTH-849-A44", "AUTH-849-A46", "AUTH-849-A47", "AUTH-849-A58", "AUTH-849-A59", "AUTH-851-A01", "AUTH-851-A02", "AUTH-851-A46", "AUTH-885-A03", "AUTH-885-A10", "AUTH-885-A17", "AUTH-885-A22", "AUTH-885-A31", "AUTH-888-A30", "AUTH-888-A37", "AUTH-894-A06", "AUTH-894-A11", "AUTH-894-A12", "AUTH-902-A01", "AUTH-902-A11", "AUTH-902-A17", "AUTH-905-A04", "AUTH-905-A09", "AUTH-905-A14", "AUTH-905-A17", "AUTH-905-A22", "AUTH-909-A02", "AUTH-909-A12", "AUTH-909-A22", "AUTH-909-A32", "AUTH-909-A42", "AUTH-913-A05", "AUTH-917", "AUTH-917-A01", "AUTH-917-A04", "AUTH-917-A05", "AUTH-917-A06", "AUTH-917-A09", "AUTH-917-A10", "AUTH-917-A11", "AUTH-917-A14", "AUTH-917-A15", "AUTH-917-A17", "AUTH-917-A20", "AUTH-917-A21", "AUTH-917-A22", "AUTH-917-A24", "AUTH-917-A25", "AUTH-917-A26", "AUTH-922-A02", "AUTH-922-A08", "AUTH-925-A05", "AUTH-925-A06", "AUTH-925-A12", "AUTH-928-A07", "AUTH-928-A13", "AUTH-928-A19", "AUTH-928-A25", "AUTH-928-A30", "AUTH-932", "AUTH-937-A01", "AUTH-937-A08", "AUTH-937-A15", "AUTH-937-A22", "AUTH-937-A29", "AUTH-941-A04", "AUTH-941-A05", "AUTH-941-A10", "AUTH-941-A11", "AUTH-941-A17", "AUTH-941-A18", "AUTH-941-A23", "AUTH-941-A24", "AUTH-954-A15", "AUTH-974-A07", "AUTH-986-A08", "AUTH-986-A09", "AUTH-989-A18", "COMP-1264-A01", "COMP-1264-A02", "COMP-1264-A04", "COMP-1264-A05", "COMP-1883-A03", "COMP-1904-A04", "COMP-1904-A06", "COMP-1904-A07", "COMP-1960-A06", "COMP-2029-A04", "COMP-2129-A04", "COMP-2131-A09", "COMP-2639-A04", "COMP-3435-A05", "COMP-3602", "COMP-3602-A01", "COMP-3602-A08", "COMP-3602-A10", "COMP-3733-A03", "COMP-3983-A02", "COMP-3983-A04", "CRYP-1097-A09", "CRYP-1124-A05", "CRYP-1210-A09", "CRYP-1299-A09", "CRYP-1306-A07", "CRYP-1372-A05", "CRYP-1386-A08", "CRYP-1393-A03", "CRYP-1433-A07", "CRYP-1466-A03", "CRYP-1466-A05", "CRYP-1712-A15", "CRYP-1725-A02", "CRYP-1750-A09", "CRYP-1761-A01", "CRYP-1864", "CRYP-1864-A02", "CRYP-1864-A05", "CRYP-1983-A01", "CRYP-2142-A06", "CRYP-2148-A06", "CRYP-2179-A09", "CRYP-2334", "CRYP-447-A16", "CRYP-450-A05", "CRYP-450-A06", "CRYP-450-A40", "CRYP-450-A52", "CRYP-450-A53", "CRYP-626", "CRYP-637-A10", "CRYP-713-A07", "CRYP-738-A06", "CRYP-790", "DATA-1191-A10", "DATA-1257-A05", "DATA-1257-A09", "DATA-1801-A06", "DATA-2493-A12", "DATA-2510-A07", "DATA-260-A02", "DATA-260-A08", "DATA-2607-A05", "DATA-2648-A01", "DATA-3292-A01", "DATA-3372-A07", "DATA-3376-A01", "DATA-3376-A06", "DATA-3401-A01", "DATA-3613-A01", "DATA-3754-A03", "DATA-4225-A04", "DATA-4317-A05", "DATA-972-A06", "DATA-972-A12", "FIN-1223-A06", "GOV-1196-A04", "GOV-180-A06", "GOV-180-A12", "GOV-2076-A13", "GOV-3110-A02", "GOV-413-A18", "GOV-519", "GOV-519-A11", "GOV-519-A35", "GOV-520-A40", "INC-1352-A03", "LOG-053-A07", "LOG-107-A02", "LOG-1742-A13", "LOG-1748-A01", "LOG-1767-A02", "LOG-1861-A06", "LOG-705-A01", "LOG-735-A17", "LOG-735-A18", "LOG-745-A44", "LOG-745-A54", "LOG-774-A01", "LOG-774-A15", "LOG-774-A22", "LOG-774-A29", "MIA-001", "NET-1014-A03", "NET-1293-A02", "NET-351", "NET-351-A01", "NET-351-A02", "NET-351-A06", "NET-351-A07", "NET-391", "NET-391-A01", "NET-391-A08", "NET-405", "NET-405-A03", "NET-405-A08", "NET-405-A09", "NET-506-A15", "NET-506-A60", "NET-857-A06", "NET-857-A12", "NET-860-A06", "NET-860-A09", "NET-980-A07", "PFI-001-A02", "SEC-052-A06", "SEC-093-A05", "SEC-093-A06", "SEC-1144-A03", "SEC-1144-A28", "SEC-1144-A42", "SEC-1144-A56", "SEC-1144-A70", "SEC-1146-A02", "SEC-1146-A07", "SEC-1146-A54", "SEC-1146-A59", "SEC-1153-A12", "SEC-2635-A03", "SEC-2643-A15", "SEC-2662-A07", "SEC-2662-A13", "SEC-2738-A06", "SEC-2809", "SEC-2809-A02", "SEC-2809-A05", "SEC-2809-A09", "SEC-2818-A05", "SEC-2899-A04", "SEC-3195-A04", "SEC-3383-A03", "SEC-3383-A08", "SEC-3732-A08", "SEC-3740-A03", "SEC-3935-A02", "SEC-3965-A02", "SEC-4292-A12", "SEC-4295", "SEC-4513-A07", "SEC-4560-A03", "SEC-4655-A03", "SEC-4655-A04", "SEC-5435-A03", "SEC-5505-A05", "SEC-5595-A13", "SEC-5767-A01", "SEC-5792-A03", "SEC-6770", "SEC-6784-A08", "SEC-6784-A10", "SEC-6804-A01", "SEC-6804-A02", "SEC-6830-A05", "SEC-6833-A07", "SEC-7984-A07", "SEC-7994-A06", "SEC-8102-A02", "SEC-8121-A05", "SEC-8138-A03", "SEC-9212-A01", "SEC-9212-A02" ], "member_count": 865, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.8, "source_meta_cluster": "M6", "cluster_size": 243, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "mfa_required", "name": "Multi-Faktor-Authentifizierung umsetzen", "description": "Multi-Faktor-Authentifizierung ist fuer Benutzerzugriffe umzusetzen, insbesondere wo erhoehtes Risiko besteht.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "mfa", "applicability": "universal", "evidence_facets": { "governance": true, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "NIST", "anchor": "SP 800-63B", "role": "best_practice" }, { "source": "Out-of-Band-Authentifizierung", "anchor": "", "role": "implementation_guidance", "merged_from": "out_of_band_authentication" }, { "source": "Hardware-basierte Authentifizierung (AAL3)", "anchor": "", "role": "implementation_guidance", "merged_from": "hardware_authenticators" }, { "source": "E-Mail-Authentifizierungsmechanismen (SPF/DKIM/DMARC)", "anchor": "", "role": "implementation_guidance", "merged_from": "email_authentication" } ], "member_review_units": [ "M1", "M94", "M95", "M38", "M110", "M113", "M126" ], "member_controls": [ "ACC-001-A14", "ACC-001-A17", "ACC-001-A29", "ACC-0410-A03", "ACC-082-A08", "ACC-082-A09", "ACC-082-A17", "ACC-082-A18", "ACC-320-A16", "ACC-320-A18", "ACC-320-A24", "ACC-320-A34", "ACC-320-A40", "ACC-320-A48", "ACC-478-A08", "ACC-499-A07", "ACC-508-A06", "ACC-559-A04", "ACC-578-A07", "ACC-607", "AI-052-A28", "AI-052-A29", "AI-1573-A01", "AI-797-A09", "AI-797-A18", "AI-797-A36", "AI-797-A45", "AI-924-A13", "AI-924-A14", "AUTH-008-A25", "AUTH-1049-A56", "AUTH-1050-A13", "AUTH-1061-A75", "AUTH-1084", "AUTH-1095-A02", "AUTH-1096", "AUTH-1096-A01", "AUTH-1102-A14", "AUTH-112-A04", "AUTH-112-A17", "AUTH-1288", "AUTH-1300-A05", "AUTH-1303-A05", "AUTH-1313-A04", "AUTH-1314-A03", "AUTH-1445-A02", "AUTH-1463-A04", "AUTH-1463-A09", "AUTH-1466-A09", "AUTH-1468-A01", "AUTH-1468-A06", "AUTH-1524-A04", "AUTH-1529-A04", "AUTH-1669-A05", "AUTH-1669-A06", "AUTH-1679", "AUTH-1679-A02", "AUTH-1711-A06", "AUTH-1742-A01", "AUTH-1742-A07", "AUTH-1759-A05", "AUTH-1790", "AUTH-1790-A04", "AUTH-1818-A11", "AUTH-1860-A05", "AUTH-1860-A08", "AUTH-1860-A09", "AUTH-1862-A09", "AUTH-1865-A12", "AUTH-187-A11", "AUTH-1901-A05", "AUTH-1910-A05", "AUTH-1912-A07", "AUTH-1940-A04", "AUTH-2121-A04", "AUTH-2315-A04", "AUTH-2338-A09", "AUTH-2399-A07", "AUTH-2405-A06", "AUTH-2452-A07", "AUTH-2473-A01", "AUTH-2473-A02", "AUTH-2484-A01", "AUTH-2548", "AUTH-2551", "AUTH-2552-A03", "AUTH-2689-A02", "AUTH-2689-A04", "AUTH-2793", "AUTH-2793-A02", "AUTH-2805-A06", "AUTH-2805-A11", "AUTH-2850", "AUTH-2851-A10", "AUTH-2873-A04", "AUTH-2879", "AUTH-2924", "AUTH-2945-A11", "AUTH-2968", "AUTH-2979-A07", "AUTH-2996", "AUTH-3004", "AUTH-3021-A07", "AUTH-3045-A04", "AUTH-3068-A06", "AUTH-3082-A10", "AUTH-3165-A02", "AUTH-3166-A07", "AUTH-3258-A09", "AUTH-3266-A07", "AUTH-3281", "AUTH-3284-A01", "AUTH-3284-A04", "AUTH-3284-A05", "AUTH-3333-A06", "AUTH-3334", "AUTH-3334-A05", "AUTH-3452-A01", "AUTH-3452-A05", "AUTH-3457", "AUTH-3460-A04", "AUTH-3461-A03", "AUTH-3461-A05", "AUTH-3469-A03", "AUTH-3486-A10", "AUTH-3541-A06", "AUTH-3542-A06", "AUTH-3547", "AUTH-3554-A02", "AUTH-3562-A01", "AUTH-3595", "AUTH-3595-A02", "AUTH-3595-A06", "AUTH-3595-A08", "AUTH-3596", "AUTH-3596-A04", "AUTH-3597-A06", "AUTH-3599-A04", "AUTH-3638", "AUTH-3652-A11", "AUTH-3653", "AUTH-3659-A01", "AUTH-3677-A04", "AUTH-3705-A02", "AUTH-3751-A08", "AUTH-3825-A08", "AUTH-3887-A01", "AUTH-3908-A05", "AUTH-3915", "AUTH-3915-A01", "AUTH-3915-A03", "AUTH-3921", "AUTH-3929-A01", "AUTH-3947", "AUTH-3948-A04", "AUTH-3958-A02", "AUTH-3964-A07", "AUTH-3968-A09", "AUTH-3977-A02", "AUTH-3993", "AUTH-3993-A02", "AUTH-4027-A02", "AUTH-4030-A03", "AUTH-4031-A08", "AUTH-4032-A02", "AUTH-4036-A04", "AUTH-4082-A10", "AUTH-4083-A05", "AUTH-4085", "AUTH-4085-A01", "AUTH-4095-A17", "AUTH-494-A02", "AUTH-500-A03", "AUTH-505-A06", "AUTH-538-A04", "AUTH-544", "AUTH-544-A06", "AUTH-544-A07", "AUTH-559-A04", "AUTH-559-A13", "AUTH-572", "AUTH-572-A02", "AUTH-572-A07", "AUTH-577-A04", "AUTH-584-A06", "AUTH-615-A06", "AUTH-623-A07", "AUTH-623-A08", "AUTH-637-A31", "AUTH-648-A02", "AUTH-661-A09", "AUTH-661-A22", "AUTH-710-A06", "AUTH-732-A01", "AUTH-743-A04", "AUTH-743-A10", "AUTH-751-A05", "AUTH-751-A06", "AUTH-751-A07", "AUTH-751-A08", "AUTH-762-A11", "AUTH-774-A01", "AUTH-784-A08", "AUTH-784-A09", "AUTH-785-A02", "AUTH-803", "AUTH-803-A03", "AUTH-803-A06", "AUTH-803-A08", "AUTH-804-A05", "AUTH-807", "AUTH-807-A01", "AUTH-810-A04", "AUTH-819-A03", "AUTH-819-A04", "AUTH-822-A03", "AUTH-822-A06", "AUTH-822-A08", "AUTH-824-A09", "AUTH-824-A15", "AUTH-824-A16", "AUTH-827-A10", "AUTH-836", "AUTH-836-A01", "AUTH-836-A02", "AUTH-836-A06", "AUTH-836-A08", "AUTH-836-A09", "AUTH-836-A12", "AUTH-836-A17", "AUTH-836-A18", "AUTH-837-A07", "AUTH-845-A02", "AUTH-845-A07", "AUTH-845-A14", "AUTH-845-A19", "AUTH-845-A25", "AUTH-845-A28", "AUTH-845-A29", "AUTH-845-A39", "AUTH-845-A46", "AUTH-845-A55", "AUTH-846-A09", "AUTH-846-A19", "AUTH-846-A29", "AUTH-846-A38", "AUTH-846-A48", "AUTH-849-A26", "AUTH-849-A27", "AUTH-849-A31", "AUTH-849-A32", "AUTH-849-A43", "AUTH-849-A44", "AUTH-849-A46", "AUTH-849-A47", "AUTH-849-A58", "AUTH-849-A59", "AUTH-902", "AUTH-903-A21", "AUTH-903-A22", "AUTH-909", "AUTH-925-A05", "AUTH-925-A06", "AUTH-925-A12", "AUTH-949-A03", "AUTH-986-A08", "AUTH-986-A09", "AUTH-989-A22", "COMP-1079-A07", "COMP-1264-A04", "COMP-1904-A06", "COMP-1904-A07", "COMP-2129-A04", "COMP-3360-A02", "COMP-3421-A13", "COMP-3435-A01", "COMP-3981-A05", "CRYP-1210-A09", "CRYP-1299-A09", "CRYP-1372-A05", "CRYP-1433-A07", "CRYP-1684-A07", "CRYP-1725-A02", "CRYP-1750-A09", "CRYP-1751", "CRYP-1751-A01", "CRYP-1864-A05", "CRYP-1884-A04", "CRYP-1927-A13", "CRYP-2142-A06", "CRYP-2148-A06", "CRYP-2173-A04", "CRYP-2179-A09", "CRYP-2334", "CRYP-447-A01", "CRYP-447-A17", "CRYP-637-A10", "CRYP-713-A07", "CRYP-723-A09", "CRYP-738-A06", "CRYP-790", "DATA-1191-A02", "DATA-1810-A02", "DATA-2493-A12", "DATA-2510-A07", "DATA-3154-A02", "DATA-3376-A06", "DATA-3614", "DATA-3754-A02", "DATA-3948", "DATA-4225-A04", "DATA-4317-A05", "GIA-002", "GOV-180-A06", "GOV-180-A12", "GOV-2076-A13", "GOV-3110-A02", "GOV-3868-A01", "GOV-3868-A07", "INC-246", "INC-246-A01", "INC-246-A02", "INC-246-A04", "LOG-107-A02", "LOG-1506-A03", "LOG-1861-A06", "LOG-967-A06", "NET-040-A03", "NET-040-A12", "NET-1166-A05", "NET-1293-A02", "NET-1787-A12", "NET-351-A09", "NET-405-A02", "NET-405-A07", "NET-857-A06", "NET-857-A12", "NET-860-A09", "NET-887-A02", "NET-887-A07", "SEC-019-A02", "SEC-019-A14", "SEC-019-A29", "SEC-052-A06", "SEC-093-A05", "SEC-093-A06", "SEC-171-A47", "SEC-2643-A07", "SEC-2643-A15", "SEC-2738-A06", "SEC-2781-A01", "SEC-2809", "SEC-2809-A02", "SEC-2809-A05", "SEC-2809-A08", "SEC-2809-A09", "SEC-3383", "SEC-3383-A01", "SEC-3383-A03", "SEC-3383-A09", "SEC-3643-A07", "SEC-3740-A03", "SEC-387-A10", "SEC-387-A24", "SEC-3870", "SEC-3965-A02", "SEC-418-A15", "SEC-4292-A12", "SEC-4295", "SEC-4513-A07", "SEC-4560-A03", "SEC-5435-A03", "SEC-5505-A05", "SEC-5767-A01", "SEC-5915-A06", "SEC-6778", "SEC-6784-A08", "SEC-6804-A01", "SEC-6804-A02", "SEC-6833-A07", "SEC-6846-A03", "SEC-7686-A01", "SEC-7686-A02", "SEC-7686-A05", "SEC-7793-A09", "SEC-7979-A02", "SEC-7984-A07", "SEC-8815", "SEC-8847-A02", "SEC-8996-A06", "SEC-9087-A02" ], "member_count": 391, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.9, "source_meta_cluster": "M94", "cluster_size": 55, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "step_up_authentication", "name": "Step-up/erneute Authentifizierung bei sensiblen Aktionen", "description": "Bei kritischen oder sensiblen Operationen ist eine Step-up- bzw. erneute Authentifizierung auszuloesen.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "session", "applicability": "conditional:sensitive_action", "evidence_facets": { "governance": true, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "NIST", "anchor": "SP 800-63B 4.3", "role": "best_practice" }, { "source": "NIST", "anchor": "SP 800-63-3", "role": "best_practice" } ], "member_review_units": [ "M0", "M4", "M112" ], "member_controls": [ "ACC-001-A09", "ACC-001-A24", "ACC-014-A07", "ACC-014-A11", "ACC-014-A16", "ACC-014-A20", "ACC-0384", "ACC-0384-A01", "ACC-0384-A05", "ACC-0411", "ACC-0411-A01", "ACC-0411-A03", "ACC-0411-A05", "ACC-0411-A09", "ACC-064-A04", "ACC-064-A09", "ACC-064-A14", "ACC-180-A07", "ACC-320-A08", "ACC-320-A15", "ACC-320-A23", "ACC-320-A31", "ACC-320-A39", "ACC-320-A47", "ACC-326-A01", "ACC-326-A12", "ACC-326-A23", "ACC-326-A34", "ACC-326-A45", "ACC-326-A56", "ACC-427-A05", "ACC-427-A14", "ACC-490-A06", "ACC-504-A05", "ACC-521-A10", "ACC-533", "ACC-533-A02", "ACC-640-A04", "ACC-640-A07", "ACC-640-A12", "ACC-647-A03", "ACC-655-A17", "ACC-660", "AI-019", "AI-1236-A08", "AI-1351-A10", "AI-1424-A03", "AI-760-A03", "AI-760-A35", "AUTH-047", "AUTH-071-A11", "AUTH-071-A12", "AUTH-1018", "AUTH-1096-A03", "AUTH-1099-A07", "AUTH-1300-A06", "AUTH-1426", "AUTH-1426-A01", "AUTH-1426-A04", "AUTH-1443-A06", "AUTH-1455-A03", "AUTH-1463-A05", "AUTH-1466-A05", "AUTH-1466-A07", "AUTH-1529-A05", "AUTH-1530", "AUTH-1530-A03", "AUTH-1633-A04", "AUTH-1640-A08", "AUTH-1652-A14", "AUTH-1654-A04", "AUTH-1667-A05", "AUTH-1667-A06", "AUTH-1670-A13", "AUTH-1671-A11", "AUTH-1672-A13", "AUTH-1677-A05", "AUTH-1694-A05", "AUTH-1709-A06", "AUTH-1806-A07", "AUTH-1811-A03", "AUTH-1813-A09", "AUTH-1823-A03", "AUTH-1823-A07", "AUTH-1826-A05", "AUTH-1830-A05", "AUTH-1834-A07", "AUTH-1859-A06", "AUTH-1862-A07", "AUTH-1908-A03", "AUTH-1917-A07", "AUTH-1932-A04", "AUTH-1932-A05", "AUTH-1945-A06", "AUTH-2315-A05", "AUTH-2397-A04", "AUTH-2409-A01", "AUTH-2417-A09", "AUTH-2425-A14", "AUTH-2426-A04", "AUTH-2461-A08", "AUTH-2466-A03", "AUTH-2466-A05", "AUTH-2466-A06", "AUTH-2486-A10", "AUTH-2573-A03", "AUTH-2635-A06", "AUTH-2641-A02", "AUTH-2678-A09", "AUTH-2781-A07", "AUTH-2781-A08", "AUTH-2817-A08", "AUTH-2819-A05", "AUTH-2851-A09", "AUTH-2883-A08", "AUTH-2886-A07", "AUTH-2926", "AUTH-2935-A05", "AUTH-2935-A10", "AUTH-2937-A09", "AUTH-2939", "AUTH-2943-A13", "AUTH-2947", "AUTH-2949", "AUTH-2955", "AUTH-2958", "AUTH-2964-A02", "AUTH-2967-A01", "AUTH-2973-A04", "AUTH-2974-A05", "AUTH-2975-A07", "AUTH-2978-A05", "AUTH-2981", "AUTH-2985-A09", "AUTH-2995-A02", "AUTH-3020-A02", "AUTH-3045-A05", "AUTH-3065-A01", "AUTH-3068-A04", "AUTH-3070-A01", "AUTH-3082-A06", "AUTH-3154-A07", "AUTH-3165-A07", "AUTH-3258-A06", "AUTH-3284-A03", "AUTH-3296-A07", "AUTH-3300-A02", "AUTH-3334", "AUTH-3334-A05", "AUTH-3393-A01", "AUTH-3430-A04", "AUTH-3542-A11", "AUTH-3543-A12", "AUTH-3548-A01", "AUTH-3595-A07", "AUTH-3597-A07", "AUTH-3597-A08", "AUTH-3635-A03", "AUTH-3635-A04", "AUTH-3641-A05", "AUTH-3647-A08", "AUTH-3659-A02", "AUTH-3670-A09", "AUTH-3825-A07", "AUTH-3900-A03", "AUTH-3906-A10", "AUTH-3906-A11", "AUTH-3908", "AUTH-3921-A09", "AUTH-3947-A05", "AUTH-3948", "AUTH-3948-A01", "AUTH-3948-A03", "AUTH-3955", "AUTH-3955-A04", "AUTH-3955-A06", "AUTH-3962-A06", "AUTH-3963-A04", "AUTH-3964-A03", "AUTH-3964-A04", "AUTH-3964-A05", "AUTH-3977", "AUTH-3977-A01", "AUTH-3977-A04", "AUTH-3984-A05", "AUTH-3997-A03", "AUTH-3999-A03", "AUTH-4004", "AUTH-4031-A05", "AUTH-4043-A03", "AUTH-4043-A04", "AUTH-4123", "AUTH-4123-A03", "AUTH-4133", "AUTH-4134", "AUTH-492-A04", "AUTH-505-A03", "AUTH-509", "AUTH-509-A02", "AUTH-637-A32", "AUTH-637-A33", "AUTH-700-A07", "AUTH-700-A08", "AUTH-710", "AUTH-739", "AUTH-739-A01", "AUTH-739-A02", "AUTH-752-A08", "AUTH-757-A12", "AUTH-762-A04", "AUTH-762-A05", "AUTH-763-A07", "AUTH-782-A02", "AUTH-782-A07", "AUTH-782-A11", "AUTH-782-A16", "AUTH-794-A07", "AUTH-837", "AUTH-837-A08", "AUTH-837-A16", "AUTH-837-A17", "AUTH-838-A03", "AUTH-838-A05", "AUTH-838-A07", "AUTH-838-A13", "AUTH-838-A15", "AUTH-838-A22", "AUTH-838-A31", "AUTH-838-A33", "AUTH-838-A41", "AUTH-838-A49", "AUTH-843", "AUTH-843-A07", "AUTH-843-A16", "AUTH-843-A25", "AUTH-843-A35", "AUTH-843-A45", "AUTH-843-A52", "AUTH-850-A06", "AUTH-850-A16", "AUTH-850-A26", "AUTH-850-A44", "AUTH-851", "AUTH-885", "AUTH-885-A25", "AUTH-885-A34", "AUTH-888", "AUTH-888-A07", "AUTH-888-A14", "AUTH-888-A22", "AUTH-888-A29", "AUTH-888-A38", "AUTH-889", "AUTH-889-A03", "AUTH-889-A11", "AUTH-889-A23", "AUTH-889-A31", "AUTH-889-A35", "AUTH-895", "AUTH-902-A07", "AUTH-902-A08", "AUTH-902-A13", "AUTH-902-A14", "AUTH-902-A18", "AUTH-926", "AUTH-932-A02", "AUTH-932-A07", "AUTH-932-A12", "AUTH-932-A18", "AUTH-932-A23", "AUTH-933", "AUTH-941-A13", "AUTH-942", "AUTH-949-A38", "AUTH-949-A56", "AUTH-989-A22", "CHP-002-A07", "CHP-004-A03", "COMP-1904-A03", "COMP-1960-A08", "COMP-2144-A03", "COMP-2876-A10", "COMP-2880-A04", "COMP-2928-A03", "COMP-3602-A03", "CRYP-1013-A10", "CRYP-1022-A07", "CRYP-1124-A03", "CRYP-1124-A07", "CRYP-1201-A02", "CRYP-1317", "CRYP-1354-A01", "CRYP-1434-A09", "CRYP-1466-A04", "CRYP-1475-A06", "CRYP-1523-A07", "CRYP-1530-A07", "CRYP-1712", "CRYP-172-A07", "CRYP-1724-A09", "CRYP-1750-A06", "CRYP-1756-A13", "CRYP-1788", "CRYP-1927-A12", "CRYP-2179-A05", "CRYP-447-A15", "CRYP-780-A06", "DATA-1881-A07", "DATA-2427-A02", "DATA-2481-A09", "DATA-2607-A07", "DATA-2660-A06", "DATA-2663-A09", "DATA-4121-A01", "GOV-008-A13", "GOV-1701-A04", "GOV-2718-A03", "GOV-3493-A09", "GOV-511-A28", "IAM-005", "IAM-005-A01", "IAM-005-A02", "IAM-005-A03", "IAM-005-A07", "IAM-005-A08", "IAM-005-A09", "IDA-002-A07", "IDA-005-A05", "IDA-005-A07", "IDA-006-A07", "IDA-007-A07", "MBT-004-A04", "NET-1012-A03", "NET-1012-A06", "NET-1014-A09", "NET-1633-A03", "NET-512-A06", "NET-512-A12", "NET-857-A07", "NET-857-A08", "NET-857-A09", "NET-860-A04", "NET-860-A07", "SEC-1153-A38", "SEC-1153-A52", "SEC-1153-A68", "SEC-1232-A07", "SEC-2853-A02", "SEC-4513-A05", "SEC-4513-A06", "SEC-4593-A03", "SEC-4593-A04", "SEC-4966-A12", "SEC-5792-A05", "SEC-5915-A07", "SEC-5915-A08", "SEC-5965-A08", "SEC-6153-A11", "SEC-6771-A07", "SEC-6784-A09", "SEC-7237-A08", "SEC-7450-A02", "SEC-7686-A06", "SEC-7962-A07", "SEC-7963-A05", "SEC-7963-A06", "SEC-8016-A06", "SEC-8103-A02", "SEC-8244", "SEC-8295-A06" ], "member_count": 370, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.85, "source_meta_cluster": "M0", "cluster_size": 166, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" }, "merged_from": [ "risk_based_authentication" ] }, { "id": "privileged_op_reauth", "name": "Explizite Authentifizierung vor privilegierten Operationen", "description": "Privilegierte Operationen erfordern explizite (Token/PIN-)Authentifizierung vor Ausfuehrung.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "credential", "applicability": "conditional:privileged_op", "evidence_facets": { "governance": false, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "NIST", "anchor": "IA-02", "role": "best_practice" }, { "source": "NIST", "anchor": "IA-02(1)", "role": "best_practice" } ], "member_review_units": [ "M4", "M11", "M160" ], "member_controls": [ "ACC-064-A04", "ACC-064-A09", "ACC-064-A14", "ACC-326-A01", "ACC-326-A12", "ACC-326-A23", "ACC-326-A34", "ACC-326-A45", "ACC-326-A56", "ACC-504-A05", "ACC-567", "ACC-567-A01", "ACC-640-A04", "ACC-640-A07", "ACC-647-A03", "ACC-660", "AI-019", "AI-1424-A03", "AI-760-A03", "AI-760-A35", "AUTH-001", "AUTH-046", "AUTH-071-A11", "AUTH-071-A12", "AUTH-1018", "AUTH-1018-A02", "AUTH-1018-A03", "AUTH-1058", "AUTH-1067", "AUTH-1102-A02", "AUTH-1102-A04", "AUTH-116-A01", "AUTH-116-A12", "AUTH-1275", "AUTH-1280", "AUTH-1295-A06", "AUTH-1303-A01", "AUTH-1303-A02", "AUTH-1310-A02", "AUTH-1314", "AUTH-1314-A01", "AUTH-1316", "AUTH-1426", "AUTH-1426-A01", "AUTH-1426-A03", "AUTH-1426-A04", "AUTH-1446-A01", "AUTH-1455-A03", "AUTH-1466-A05", "AUTH-1525", "AUTH-1529-A03", "AUTH-1529-A07", "AUTH-1530", "AUTH-1530-A03", "AUTH-1634-A03", "AUTH-1638-A01", "AUTH-1645-A03", "AUTH-1649-A01", "AUTH-1649-A03", "AUTH-1649-A04", "AUTH-1677-A03", "AUTH-1682-A02", "AUTH-1684-A04", "AUTH-1688-A06", "AUTH-1701", "AUTH-1701-A02", "AUTH-1701-A05", "AUTH-1709-A06", "AUTH-1711", "AUTH-1711-A01", "AUTH-1711-A03", "AUTH-1711-A05", "AUTH-1716-A01", "AUTH-1720", "AUTH-1720-A02", "AUTH-1721-A02", "AUTH-1810-A04", "AUTH-1813-A08", "AUTH-1823-A03", "AUTH-1826-A05", "AUTH-1896", "AUTH-1896-A02", "AUTH-1896-A03", "AUTH-1896-A04", "AUTH-1901-A03", "AUTH-1908-A03", "AUTH-1917-A07", "AUTH-1945-A06", "AUTH-2315", "AUTH-2315-A03", "AUTH-2315-A05", "AUTH-2316-A01", "AUTH-2316-A02", "AUTH-2317-A03", "AUTH-2322-A01", "AUTH-2338-A01", "AUTH-2338-A05", "AUTH-2368-A01", "AUTH-2368-A02", "AUTH-2368-A05", "AUTH-2397-A04", "AUTH-2409-A01", "AUTH-2419-A04", "AUTH-2419-A05", "AUTH-2426-A04", "AUTH-2452-A01", "AUTH-2452-A02", "AUTH-2452-A03", "AUTH-2452-A08", "AUTH-2452-A09", "AUTH-2461", "AUTH-2461-A01", "AUTH-2466-A03", "AUTH-2466-A05", "AUTH-2466-A06", "AUTH-2473-A01", "AUTH-2473-A02", "AUTH-2475-A04", "AUTH-2484-A01", "AUTH-2486-A10", "AUTH-2552-A03", "AUTH-2689", "AUTH-2689-A01", "AUTH-2689-A02", "AUTH-2689-A03", "AUTH-2689-A05", "AUTH-2819-A05", "AUTH-2822-A02", "AUTH-2822-A07", "AUTH-2866-A02", "AUTH-2873-A03", "AUTH-2877", "AUTH-2877-A02", "AUTH-2883-A04", "AUTH-2883-A08", "AUTH-2886-A01", "AUTH-2886-A07", "AUTH-2926", "AUTH-2930-A01", "AUTH-2930-A08", "AUTH-2935-A05", "AUTH-2935-A10", "AUTH-2937-A04", "AUTH-2939", "AUTH-2944-A12", "AUTH-2946-A02", "AUTH-2947", "AUTH-2949", "AUTH-2955", "AUTH-2956-A04", "AUTH-2958", "AUTH-2963-A05", "AUTH-2964-A02", "AUTH-2965-A05", "AUTH-2967-A01", "AUTH-2968", "AUTH-2968-A05", "AUTH-2969-A01", "AUTH-2973-A04", "AUTH-2978-A05", "AUTH-2981", "AUTH-2981-A07", "AUTH-2982-A01", "AUTH-2987", "AUTH-2987-A08", "AUTH-2987-A09", "AUTH-2993", "AUTH-2993-A04", "AUTH-2994", "AUTH-2995-A02", "AUTH-2996", "AUTH-2996-A07", "AUTH-3002-A06", "AUTH-3011", "AUTH-3011-A01", "AUTH-3012", "AUTH-3013-A04", "AUTH-3013-A07", "AUTH-3015", "AUTH-3015-A01", "AUTH-3015-A02", "AUTH-3018", "AUTH-3018-A04", "AUTH-3021-A07", "AUTH-3045-A05", "AUTH-3064", "AUTH-3064-A01", "AUTH-3064-A03", "AUTH-3065-A01", "AUTH-3070-A01", "AUTH-3074", "AUTH-3074-A05", "AUTH-3151-A03", "AUTH-3155-A05", "AUTH-3165-A02", "AUTH-3258-A06", "AUTH-3286-A02", "AUTH-3305-A01", "AUTH-3333-A06", "AUTH-3393-A01", "AUTH-3452-A01", "AUTH-3452-A05", "AUTH-3454-A01", "AUTH-3454-A05", "AUTH-3454-A06", "AUTH-3454-A07", "AUTH-3460", "AUTH-3460-A06", "AUTH-3461", "AUTH-3461-A01", "AUTH-3461-A07", "AUTH-3469-A03", "AUTH-3541-A02", "AUTH-3541-A07", "AUTH-3543-A01", "AUTH-3545-A04", "AUTH-3547", "AUTH-3594", "AUTH-3594-A01", "AUTH-3594-A02", "AUTH-3594-A07", "AUTH-3595-A07", "AUTH-3596-A01", "AUTH-3596-A07", "AUTH-3599", "AUTH-3635-A03", "AUTH-3635-A04", "AUTH-3635-A05", "AUTH-3652-A05", "AUTH-3652-A06", "AUTH-3659-A01", "AUTH-3659-A02", "AUTH-3705-A02", "AUTH-3705-A06", "AUTH-3751", "AUTH-3825-A07", "AUTH-3825-A08", "AUTH-3887-A01", "AUTH-3900", "AUTH-3900-A01", "AUTH-3900-A02", "AUTH-3900-A03", "AUTH-3900-A05", "AUTH-3906-A03", "AUTH-3906-A04", "AUTH-3906-A10", "AUTH-3906-A11", "AUTH-3908", "AUTH-3908-A05", "AUTH-3915", "AUTH-3915-A01", "AUTH-3915-A03", "AUTH-3921-A09", "AUTH-3929-A01", "AUTH-3946-A01", "AUTH-3947-A05", "AUTH-3948", "AUTH-3948-A01", "AUTH-3948-A03", "AUTH-3955", "AUTH-3955-A02", "AUTH-3955-A03", "AUTH-3955-A04", "AUTH-3955-A06", "AUTH-3962-A06", "AUTH-3963-A01", "AUTH-3963-A02", "AUTH-3963-A04", "AUTH-3968-A09", "AUTH-3969-A02", "AUTH-3977", "AUTH-3977-A01", "AUTH-3977-A02", "AUTH-3977-A04", "AUTH-3982-A01", "AUTH-3984-A05", "AUTH-3984-A06", "AUTH-3988-A04", "AUTH-3997-A03", "AUTH-3999-A03", "AUTH-3999-A04", "AUTH-4031-A05", "AUTH-4035-A01", "AUTH-4069-A02", "AUTH-4072-A13", "AUTH-4076", "AUTH-4079-A04", "AUTH-4083-A05", "AUTH-4123-A03", "AUTH-4127", "AUTH-4130-A02", "AUTH-492-A04", "AUTH-500-A03", "AUTH-505-A03", "AUTH-520-A04", "AUTH-538", "AUTH-538-A04", "AUTH-551", "AUTH-551-A02", "AUTH-559-A17", "AUTH-606", "AUTH-616-A04", "AUTH-616-A14", "AUTH-616-A17", "AUTH-637-A32", "AUTH-637-A33", "AUTH-648", "AUTH-648-A02", "AUTH-680-A04", "AUTH-700", "AUTH-710", "AUTH-738", "AUTH-754-A05", "AUTH-754-A07", "AUTH-754-A12", "AUTH-762-A04", "AUTH-762-A05", "AUTH-763-A06", "AUTH-766-A06", "AUTH-769-A07", "AUTH-774-A03", "AUTH-785-A02", "AUTH-803", "AUTH-803-A02", "AUTH-803-A06", "AUTH-803-A08", "AUTH-807", "AUTH-807-A01", "AUTH-807-A04", "AUTH-813", "AUTH-815", "AUTH-824-A09", "AUTH-824-A16", "AUTH-825", "AUTH-827", "AUTH-831-A03", "AUTH-831-A05", "AUTH-837", "AUTH-837-A08", "AUTH-837-A16", "AUTH-837-A17", "AUTH-838-A03", "AUTH-838-A05", "AUTH-838-A07", "AUTH-838-A15", "AUTH-838-A33", "AUTH-843", "AUTH-843-A07", "AUTH-843-A16", "AUTH-843-A25", "AUTH-843-A35", "AUTH-843-A45", "AUTH-843-A52", "AUTH-845-A02", "AUTH-845-A04", "AUTH-845-A05", "AUTH-845-A14", "AUTH-845-A17", "AUTH-845-A25", "AUTH-845-A28", "AUTH-845-A36", "AUTH-845-A37", "AUTH-845-A46", "AUTH-845-A48", "AUTH-845-A49", "AUTH-845-A52", "AUTH-845-A53", "AUTH-850-A06", "AUTH-850-A16", "AUTH-850-A26", "AUTH-850-A44", "AUTH-851", "AUTH-851-A16", "AUTH-855-A01", "AUTH-855-A02", "AUTH-855-A16", "AUTH-855-A17", "AUTH-855-A31", "AUTH-855-A32", "AUTH-855-A46", "AUTH-855-A47", "AUTH-855-A48", "AUTH-855-A61", "AUTH-855-A62", "AUTH-867-A20", "AUTH-889-A03", "AUTH-889-A11", "AUTH-889-A23", "AUTH-889-A31", "AUTH-889-A35", "AUTH-893-A10", "AUTH-893-A22", "AUTH-895", "AUTH-902", "AUTH-902-A07", "AUTH-902-A08", "AUTH-902-A13", "AUTH-902-A14", "AUTH-902-A18", "AUTH-903-A21", "AUTH-903-A22", "AUTH-939", "AUTH-939-A01", "AUTH-939-A02", "AUTH-939-A09", "AUTH-939-A19", "AUTH-939-A26", "AUTH-939-A31", "AUTH-939-A42", "AUTH-951", "AVL-003-A06", "BND-002-A02", "BND-002-A04", "BND-002-A06", "BND-002-A08", "COMP-1904", "COMP-1904-A03", "COMP-2144-A03", "COMP-2780-A04", "COMP-2880-A04", "COMP-2928-A03", "COMP-3313-A03", "COMP-3435-A01", "COMP-3602-A03", "CRYP-1079-A08", "CRYP-1124-A03", "CRYP-1201-A02", "CRYP-1269", "CRYP-1269-A01", "CRYP-1269-A02", "CRYP-1288-A04", "CRYP-1354-A01", "CRYP-1359-A05", "CRYP-1394-A03", "CRYP-1652-A09", "CRYP-1700-A02", "CRYP-1751", "CRYP-1751-A01", "CRYP-1751-A02", "CRYP-1756-A13", "CRYP-1788", "CRYP-1819-A01", "CRYP-1927-A06", "CRYP-2179-A05", "CRYP-2287", "CRYP-2301-A06", "CRYP-2315-A06", "CRYP-2355-A01", "CRYP-626-A05", "CRYP-876-A06", "DATA-1007-A02", "DATA-1007-A09", "DATA-1007-A11", "DATA-1801", "DATA-2427-A02", "DATA-259", "DATA-2662-A05", "DATA-3154-A06", "DATA-3613-A04", "DATA-3614-A02", "DATA-4121-A01", "GIA-002", "GIA-002-A10", "GOV-008-A13", "GOV-1701-A04", "GOV-3868-A11", "GOV-511-A28", "IAM-005", "IAM-005-A02", "IAM-005-A08", "LOG-1506-A03", "LOG-967", "LOG-967-A01", "LOG-967-A03", "LOG-967-A05", "LOG-967-A06", "NET-040-A03", "NET-040-A12", "NET-1014-A09", "NET-1166-A05", "NET-1243-A05", "NET-1345-A02", "NET-1633-A02", "NET-1787-A12", "NET-465-A02", "NET-465-A07", "NET-928-A02", "PRC-012-A01", "SEC-1223-A05", "SEC-1232-A07", "SEC-171-A47", "SEC-2445-A01", "SEC-2643-A07", "SEC-2781-A01", "SEC-2853-A02", "SEC-3157-A03", "SEC-3157-A07", "SEC-387-A10", "SEC-387-A24", "SEC-3870", "SEC-4010-A09", "SEC-4021-A03", "SEC-418-A15", "SEC-4254-A03", "SEC-4561", "SEC-4561-A02", "SEC-4566-A04", "SEC-4593-A03", "SEC-4593-A04", "SEC-5610", "SEC-5640-A04", "SEC-5792-A01", "SEC-5915-A05", "SEC-5915-A06", "SEC-5915-A07", "SEC-5915-A08", "SEC-6775", "SEC-7686-A05", "SEC-7793-A05", "SEC-7962-A07", "SEC-7984", "SEC-7984-A01", "SEC-7984-A04", "SEC-7984-A08", "SEC-8103-A02", "SEC-8244", "SEC-8825-A04", "SEC-8825-A05", "SEC-8847-A02", "SEC-9065-A01" ], "member_count": 530, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.82, "source_meta_cluster": "M4", "cluster_size": 159, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" }, "merged_from": [ "mfa_privileged_access" ] }, { "id": "strong_crypto_authentication", "name": "Kryptographische Verfahren fuer Authentifizierung", "description": "Authentifizierungsmechanismen muessen auf robusten, anerkannten kryptographischen Verfahren beruhen und gegen Angriffe robust sein.", "tier": "LEGAL_MINIMUM", "family": "authentication", "subdomain": "credential", "applicability": "universal", "evidence_facets": { "governance": true, "capability": true, "evidence": true }, "source_role": "LEGAL_BASIS", "legal_basis": [ { "source": "CRA", "regulation_code": "eu_2024_2847", "anchor": "Annex I (2)(e)", "citation": "protect the confidentiality... through state-of-the-art mechanisms incl. encryption" } ], "guidance_basis": [ { "source": "BSI", "anchor": "TR-02102", "role": "best_practice" }, { "source": "Ephemere Schluessel bei Authentifizierung", "anchor": "", "role": "implementation_guidance", "merged_from": "ephemeral_key_auth" }, { "source": "Nachrichtenauthentifizierung (MAC)", "anchor": "", "role": "implementation_guidance", "merged_from": "message_authentication_codes" }, { "source": "Replay-Schutz mit Nonces", "anchor": "", "role": "implementation_guidance", "merged_from": "replay_protection_nonce" }, { "source": "Challenge-Response-Authentifizierung", "anchor": "", "role": "implementation_guidance", "merged_from": "challenge_response_auth" }, { "source": "Datenursprungs-/Domaenenauthentifizierung", "anchor": "", "role": "implementation_guidance", "merged_from": "data_origin_authentication" }, { "source": "Zugelassene Hash-Funktionen fuer Authentifizierung", "anchor": "", "role": "implementation_guidance", "merged_from": "approved_hash_functions" } ], "member_review_units": [ "M1", "M16", "M59", "M82", "M85", "M96", "M106", "M140", "M143" ], "member_controls": [ "ACC-001-A14", "ACC-001-A17", "ACC-001-A29", "ACC-0357", "ACC-0357-A01", "ACC-0357-A02", "ACC-0357-A03", "ACC-0357-A06", "ACC-0410-A03", "ACC-082-A08", "ACC-082-A09", "ACC-082-A17", "ACC-082-A18", "ACC-320-A16", "ACC-320-A18", "ACC-320-A24", "ACC-320-A34", "ACC-320-A40", "ACC-320-A48", "ACC-478-A08", "ACC-499-A07", "ACC-508-A06", "ACC-559-A04", "ACC-578-A07", "ACC-607", "AI-052-A28", "AI-052-A29", "AI-1027", "AI-1027-A06", "AI-797-A09", "AI-797-A18", "AI-797-A36", "AI-797-A45", "AI-924-A13", "AI-924-A14", "AUT-001", "AUT-002", "AUTH-008-A25", "AUTH-1005-A01", "AUTH-1049-A56", "AUTH-1050-A13", "AUTH-1052-A13", "AUTH-1052-A22", "AUTH-1052-A36", "AUTH-1061-A75", "AUTH-1084", "AUTH-1095-A02", "AUTH-1096", "AUTH-1096-A01", "AUTH-1102-A14", "AUTH-112-A04", "AUTH-112-A17", "AUTH-1288", "AUTH-1300-A05", "AUTH-1313-A04", "AUTH-1314-A03", "AUTH-1445-A02", "AUTH-1463-A04", "AUTH-1463-A09", "AUTH-1466-A09", "AUTH-1468-A01", "AUTH-1468-A06", "AUTH-1524-A04", "AUTH-1529-A04", "AUTH-1648", "AUTH-1648-A05", "AUTH-1649-A02", "AUTH-1650-A05", "AUTH-1650-A06", "AUTH-1658", "AUTH-1658-A01", "AUTH-1658-A03", "AUTH-1658-A04", "AUTH-1658-A06", "AUTH-1658-A07", "AUTH-1658-A10", "AUTH-1660", "AUTH-1660-A03", "AUTH-1664", "AUTH-1667-A07", "AUTH-1669-A05", "AUTH-1669-A06", "AUTH-1671-A08", "AUTH-1678", "AUTH-1678-A06", "AUTH-1679", "AUTH-1679-A02", "AUTH-1680", "AUTH-1680-A03", "AUTH-1680-A06", "AUTH-1681", "AUTH-1681-A01", "AUTH-1688", "AUTH-1692-A05", "AUTH-1693-A07", "AUTH-1702-A06", "AUTH-1711-A06", "AUTH-1742-A01", "AUTH-1742-A07", "AUTH-1750-A03", "AUTH-1759-A05", "AUTH-1776-A08", "AUTH-1779", "AUTH-1779-A01", "AUTH-1790", "AUTH-1808-A03", "AUTH-1815", "AUTH-1815-A01", "AUTH-1817-A01", "AUTH-1817-A03", "AUTH-1818-A11", "AUTH-1831-A03", "AUTH-1835", "AUTH-1835-A01", "AUTH-1839", "AUTH-1839-A01", "AUTH-1839-A02", "AUTH-1839-A04", "AUTH-1843-A02", "AUTH-1844", "AUTH-1845-A04", "AUTH-1846", "AUTH-1849", "AUTH-1858-A01", "AUTH-1860", "AUTH-1860-A02", "AUTH-1860-A05", "AUTH-1860-A08", "AUTH-1860-A09", "AUTH-1862-A09", "AUTH-1864", "AUTH-1864-A01", "AUTH-1864-A02", "AUTH-1864-A04", "AUTH-1864-A05", "AUTH-1864-A06", "AUTH-1864-A07", "AUTH-1864-A08", "AUTH-1865-A12", "AUTH-187-A11", "AUTH-1908", "AUTH-1910", "AUTH-1910-A01", "AUTH-1910-A03", "AUTH-1910-A04", "AUTH-1910-A05", "AUTH-1910-A07", "AUTH-1910-A08", "AUTH-1910-A10", "AUTH-1911-A02", "AUTH-1912-A02", "AUTH-1912-A06", "AUTH-1912-A07", "AUTH-1919-A07", "AUTH-1930-A01", "AUTH-1932-A03", "AUTH-1933", "AUTH-1935", "AUTH-1940-A01", "AUTH-1940-A04", "AUTH-1944", "AUTH-1944-A01", "AUTH-1947", "AUTH-1949", "AUTH-1949-A01", "AUTH-1949-A07", "AUTH-1949-A08", "AUTH-1949-A09", "AUTH-2121-A04", "AUTH-2315-A04", "AUTH-2338-A09", "AUTH-2368-A07", "AUTH-2382", "AUTH-2399-A07", "AUTH-2405-A06", "AUTH-2444-A02", "AUTH-2553", "AUTH-2553-A02", "AUTH-2689-A06", "AUTH-2793", "AUTH-2793-A02", "AUTH-2793-A04", "AUTH-2805-A06", "AUTH-2805-A11", "AUTH-2822", "AUTH-2850", "AUTH-2851-A10", "AUTH-2852-A02", "AUTH-2873-A02", "AUTH-2879", "AUTH-2883-A06", "AUTH-2913-A04", "AUTH-2930-A12", "AUTH-2979-A07", "AUTH-3004", "AUTH-3021-A03", "AUTH-3024", "AUTH-3024-A03", "AUTH-3045-A04", "AUTH-3068-A06", "AUTH-3074-A04", "AUTH-3075-A04", "AUTH-3082-A10", "AUTH-3150-A02", "AUTH-3150-A08", "AUTH-3154-A05", "AUTH-3155-A09", "AUTH-3266-A07", "AUTH-3279-A01", "AUTH-3305-A05", "AUTH-3305-A08", "AUTH-3455-A08", "AUTH-3460-A04", "AUTH-3461-A03", "AUTH-3461-A05", "AUTH-3486-A10", "AUTH-3541-A03", "AUTH-3541-A06", "AUTH-3541-A08", "AUTH-3542-A06", "AUTH-3545-A07", "AUTH-3550", "AUTH-3550-A01", "AUTH-3554-A02", "AUTH-3595", "AUTH-3595-A06", "AUTH-3595-A08", "AUTH-3596", "AUTH-3596-A04", "AUTH-3597-A06", "AUTH-3597-A10", "AUTH-3599-A04", "AUTH-3624-A06", "AUTH-3638", "AUTH-3642-A04", "AUTH-3644", "AUTH-3751-A08", "AUTH-3948-A04", "AUTH-3958-A02", "AUTH-3963-A03", "AUTH-3964-A07", "AUTH-3993", "AUTH-3993-A02", "AUTH-4027-A02", "AUTH-4030-A03", "AUTH-4031-A08", "AUTH-4032-A02", "AUTH-4032-A14", "AUTH-4036-A04", "AUTH-4040", "AUTH-4085", "AUTH-4085-A01", "AUTH-4095-A17", "AUTH-452-A04", "AUTH-474-A07", "AUTH-494-A02", "AUTH-505", "AUTH-505-A02", "AUTH-505-A06", "AUTH-515", "AUTH-515-A02", "AUTH-515-A03", "AUTH-515-A04", "AUTH-515-A07", "AUTH-524-A02", "AUTH-524-A06", "AUTH-524-A09", "AUTH-550", "AUTH-550-A01", "AUTH-550-A06", "AUTH-558-A01", "AUTH-559-A04", "AUTH-559-A13", "AUTH-584-A06", "AUTH-586", "AUTH-586-A01", "AUTH-615-A06", "AUTH-623-A07", "AUTH-623-A08", "AUTH-666", "AUTH-666-A01", "AUTH-700-A01", "AUTH-710-A06", "AUTH-732-A01", "AUTH-743-A04", "AUTH-743-A10", "AUTH-751", "AUTH-751-A05", "AUTH-751-A06", "AUTH-751-A07", "AUTH-751-A08", "AUTH-762-A11", "AUTH-774-A01", "AUTH-783", "AUTH-784-A08", "AUTH-784-A09", "AUTH-789-A03", "AUTH-804-A05", "AUTH-818-A19", "AUTH-820", "AUTH-820-A01", "AUTH-822-A06", "AUTH-822-A08", "AUTH-824-A15", "AUTH-836", "AUTH-836-A01", "AUTH-836-A02", "AUTH-836-A06", "AUTH-836-A08", "AUTH-836-A09", "AUTH-836-A12", "AUTH-836-A17", "AUTH-836-A18", "AUTH-837-A07", "AUTH-845-A07", "AUTH-845-A19", "AUTH-845-A29", "AUTH-845-A39", "AUTH-845-A55", "AUTH-846-A04", "AUTH-846-A09", "AUTH-846-A13", "AUTH-846-A19", "AUTH-846-A23", "AUTH-846-A29", "AUTH-846-A33", "AUTH-846-A38", "AUTH-846-A42", "AUTH-846-A48", "AUTH-849-A26", "AUTH-849-A27", "AUTH-849-A31", "AUTH-849-A32", "AUTH-849-A43", "AUTH-849-A44", "AUTH-849-A46", "AUTH-849-A47", "AUTH-849-A58", "AUTH-849-A59", "AUTH-898", "AUTH-898-A09", "AUTH-898-A17", "AUTH-925-A05", "AUTH-925-A06", "AUTH-925-A12", "AUTH-944", "AUTH-944-A05", "AUTH-986-A08", "AUTH-986-A09", "COMP-1055", "COMP-1264-A04", "COMP-1266", "COMP-1883-A07", "COMP-1904-A06", "COMP-1904-A07", "COMP-2028-A07", "COMP-2060-A01", "COMP-2129-A04", "CRYP-1116-A02", "CRYP-1134-A06", "CRYP-1150-A06", "CRYP-1162-A04", "CRYP-1201-A01", "CRYP-1203-A01", "CRYP-1210-A09", "CRYP-1217-A02", "CRYP-1267", "CRYP-1267-A02", "CRYP-1286", "CRYP-1286-A02", "CRYP-1288-A10", "CRYP-1293-A08", "CRYP-1299-A09", "CRYP-1316-A05", "CRYP-1336", "CRYP-1336-A02", "CRYP-1336-A06", "CRYP-1372-A05", "CRYP-1378", "CRYP-1382", "CRYP-1385", "CRYP-1385-A03", "CRYP-1385-A05", "CRYP-1385-A07", "CRYP-1389", "CRYP-1404", "CRYP-1421", "CRYP-1421-A01", "CRYP-1421-A07", "CRYP-1421-A10", "CRYP-1424-A03", "CRYP-1433-A07", "CRYP-1434-A03", "CRYP-1449-A04", "CRYP-1449-A11", "CRYP-1463", "CRYP-1463-A03", "CRYP-1467-A03", "CRYP-1467-A08", "CRYP-1469-A02", "CRYP-1469-A07", "CRYP-1469-A08", "CRYP-1475", "CRYP-1520-A05", "CRYP-1520-A10", "CRYP-1522-A02", "CRYP-1523", "CRYP-1523-A02", "CRYP-1523-A04", "CRYP-1523-A08", "CRYP-1524-A04", "CRYP-1525-A08", "CRYP-1531-A02", "CRYP-1531-A05", "CRYP-1535", "CRYP-1535-A04", "CRYP-1535-A05", "CRYP-1535-A11", "CRYP-1537", "CRYP-1539-A03", "CRYP-1539-A08", "CRYP-1725-A02", "CRYP-1750-A09", "CRYP-1750-A13", "CRYP-1793", "CRYP-1864-A05", "CRYP-193-A03", "CRYP-1993-A03", "CRYP-2142-A06", "CRYP-2148-A01", "CRYP-2148-A06", "CRYP-2179-A09", "CRYP-2334", "CRYP-637-A10", "CRYP-713-A07", "CRYP-738-A06", "CRYP-790", "CRYP-796-A08", "CRYP-809", "CRYP-809-A01", "CRYP-848", "DATA-1274-A03", "DATA-1499-A06", "DATA-2427-A06", "DATA-2493-A12", "DATA-2510-A07", "DATA-3376-A06", "DATA-4225-A04", "DATA-4317-A05", "DATA-879-A07", "DATA-879-A10", "DATA-879-A14", "GOV-1439-A09", "GOV-1732-A01", "GOV-1733-A04", "GOV-180-A06", "GOV-180-A12", "GOV-2076-A13", "GOV-3110-A02", "IDF-004", "IDF-004-A01", "IDF-006", "INC-978-A09", "INC-978-A10", "INC-978-A11", "LOG-107-A02", "LOG-1861-A06", "MSG-003", "NET-1015-A02", "NET-1233-A07", "NET-1293-A02", "NET-1467-A13", "NET-1482-A11", "NET-651-A03", "NET-651-A13", "NET-651-A23", "NET-651-A33", "NET-651-A43", "NET-651-A54", "NET-758-A01", "NET-758-A07", "NET-758-A14", "NET-758-A20", "NET-758-A28", "NET-857-A06", "NET-857-A12", "NET-860-A09", "NET-879-A03", "NET-991-A07", "NET-991-A08", "SEC-052-A06", "SEC-093-A05", "SEC-093-A06", "SEC-2176-A03", "SEC-2643-A15", "SEC-2738-A06", "SEC-2809", "SEC-2809-A02", "SEC-2809-A03", "SEC-2809-A05", "SEC-2809-A09", "SEC-2839-A02", "SEC-2845-A09", "SEC-3383-A03", "SEC-3605", "SEC-3728-A11", "SEC-3740-A03", "SEC-3965-A02", "SEC-4015-A08", "SEC-4089-A08", "SEC-4090", "SEC-4090-A04", "SEC-4090-A05", "SEC-4090-A08", "SEC-4217", "SEC-4292-A11", "SEC-4292-A12", "SEC-4295", "SEC-4295-A01", "SEC-4508", "SEC-4509-A07", "SEC-4513-A07", "SEC-4560-A03", "SEC-5435-A03", "SEC-5505-A05", "SEC-5767-A01", "SEC-6784-A08", "SEC-6804-A01", "SEC-6804-A02", "SEC-6833-A07", "SEC-7984-A07", "SEC-8241-A01", "SEC-8257-A10" ], "member_count": 533, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.85, "source_meta_cluster": "M1", "cluster_size": 234, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "credential_lifecycle_management", "name": "Verwaltung von Authentifizierungsmitteln (Lifecycle)", "description": "Authentifizierungsmittel sind ueber ihren gesamten Lebenszyklus (Ausstellung, Erneuerung, Sperrung, Loeschung) zu verwalten und aktuell zu halten.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "credential", "applicability": "universal", "evidence_facets": { "governance": true, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "ISO", "anchor": "ISO 27001 A.5.17", "role": "best_practice" }, { "source": "NIST", "anchor": "MP-06", "role": "best_practice" } ], "member_review_units": [ "M1", "M30", "M44", "M63", "M93" ], "member_controls": [ "ACC-001-A14", "ACC-001-A17", "ACC-001-A29", "ACC-0410-A03", "ACC-082-A08", "ACC-082-A09", "ACC-082-A17", "ACC-082-A18", "ACC-320-A16", "ACC-320-A18", "ACC-320-A24", "ACC-320-A34", "ACC-320-A40", "ACC-320-A48", "ACC-478-A08", "ACC-499-A07", "ACC-508-A06", "ACC-559-A04", "ACC-578-A07", "ACC-607", "AI-052-A28", "AI-052-A29", "AI-797-A09", "AI-797-A18", "AI-797-A36", "AI-797-A45", "AI-924-A13", "AI-924-A14", "AUTH-008-A25", "AUTH-1049-A35", "AUTH-1049-A50", "AUTH-1049-A56", "AUTH-1050-A13", "AUTH-1061-A75", "AUTH-1084", "AUTH-1095-A02", "AUTH-1096", "AUTH-1096-A01", "AUTH-1102-A14", "AUTH-112-A04", "AUTH-112-A17", "AUTH-1288", "AUTH-1300-A05", "AUTH-1313-A04", "AUTH-1314-A03", "AUTH-1445-A02", "AUTH-1463-A04", "AUTH-1463-A09", "AUTH-1466-A09", "AUTH-1468-A01", "AUTH-1468-A06", "AUTH-1480", "AUTH-1480-A01", "AUTH-1524-A04", "AUTH-1529-A04", "AUTH-1637", "AUTH-1637-A01", "AUTH-1661-A01", "AUTH-1669-A05", "AUTH-1669-A06", "AUTH-1670", "AUTH-1677-A02", "AUTH-1677-A08", "AUTH-1678-A03", "AUTH-1679", "AUTH-1679-A02", "AUTH-1700-A03", "AUTH-1706", "AUTH-1706-A01", "AUTH-1706-A02", "AUTH-1706-A07", "AUTH-1706-A08", "AUTH-1711-A06", "AUTH-1725", "AUTH-1742-A01", "AUTH-1742-A07", "AUTH-1746", "AUTH-1746-A01", "AUTH-1759-A05", "AUTH-1790", "AUTH-1813-A07", "AUTH-1818-A11", "AUTH-1860-A05", "AUTH-1860-A08", "AUTH-1860-A09", "AUTH-1862-A09", "AUTH-1865-A12", "AUTH-187-A11", "AUTH-1910-A05", "AUTH-1912-A07", "AUTH-1940-A04", "AUTH-2121-A04", "AUTH-2315-A04", "AUTH-2338-A09", "AUTH-2338-A10", "AUTH-2371-A05", "AUTH-2399-A07", "AUTH-2405-A06", "AUTH-2416-A07", "AUTH-2438", "AUTH-2464", "AUTH-2793", "AUTH-2793-A02", "AUTH-2805-A06", "AUTH-2805-A11", "AUTH-2817-A01", "AUTH-2817-A02", "AUTH-2850", "AUTH-2851-A10", "AUTH-2879", "AUTH-2979-A07", "AUTH-3004", "AUTH-3045-A04", "AUTH-3068", "AUTH-3068-A01", "AUTH-3068-A03", "AUTH-3068-A05", "AUTH-3068-A06", "AUTH-3073-A01", "AUTH-3082-A10", "AUTH-3161", "AUTH-3258-A08", "AUTH-3266-A07", "AUTH-3460-A04", "AUTH-3461-A03", "AUTH-3461-A05", "AUTH-3486-A10", "AUTH-3541-A06", "AUTH-3542-A06", "AUTH-3554-A01", "AUTH-3554-A02", "AUTH-3554-A05", "AUTH-3595", "AUTH-3595-A06", "AUTH-3595-A08", "AUTH-3596", "AUTH-3596-A04", "AUTH-3597-A06", "AUTH-3599-A04", "AUTH-3638", "AUTH-3712", "AUTH-3751-A08", "AUTH-3948-A04", "AUTH-3958-A02", "AUTH-3964-A07", "AUTH-3993", "AUTH-3993-A02", "AUTH-4006-A14", "AUTH-4027-A02", "AUTH-4030-A03", "AUTH-4031-A08", "AUTH-4032-A02", "AUTH-4036-A04", "AUTH-4085", "AUTH-4085-A01", "AUTH-4095-A17", "AUTH-4130-A03", "AUTH-4135-A01", "AUTH-494-A02", "AUTH-505-A06", "AUTH-559-A04", "AUTH-559-A13", "AUTH-584-A06", "AUTH-615-A06", "AUTH-623-A07", "AUTH-623-A08", "AUTH-710-A06", "AUTH-732-A01", "AUTH-743-A04", "AUTH-743-A10", "AUTH-751-A05", "AUTH-751-A06", "AUTH-751-A07", "AUTH-751-A08", "AUTH-762-A11", "AUTH-774-A01", "AUTH-784-A08", "AUTH-784-A09", "AUTH-804-A05", "AUTH-822-A06", "AUTH-822-A08", "AUTH-824-A15", "AUTH-827-A04", "AUTH-827-A13", "AUTH-836", "AUTH-836-A01", "AUTH-836-A02", "AUTH-836-A06", "AUTH-836-A08", "AUTH-836-A09", "AUTH-836-A12", "AUTH-836-A17", "AUTH-836-A18", "AUTH-837-A07", "AUTH-845-A07", "AUTH-845-A19", "AUTH-845-A29", "AUTH-845-A39", "AUTH-845-A55", "AUTH-846-A09", "AUTH-846-A19", "AUTH-846-A29", "AUTH-846-A38", "AUTH-846-A48", "AUTH-849-A26", "AUTH-849-A27", "AUTH-849-A31", "AUTH-849-A32", "AUTH-849-A43", "AUTH-849-A44", "AUTH-849-A46", "AUTH-849-A47", "AUTH-849-A58", "AUTH-849-A59", "AUTH-925-A05", "AUTH-925-A06", "AUTH-925-A12", "AUTH-986-A08", "AUTH-986-A09", "COMP-1264-A04", "COMP-1904-A06", "COMP-1904-A07", "COMP-1960-A07", "COMP-2129-A04", "CRYP-1089-A02", "CRYP-1210-A09", "CRYP-1214-A04", "CRYP-1299-A09", "CRYP-1372-A05", "CRYP-1433-A07", "CRYP-1725-A02", "CRYP-1750-A09", "CRYP-1751-A10", "CRYP-1751-A11", "CRYP-1864-A05", "CRYP-2142-A06", "CRYP-2148-A06", "CRYP-2179-A09", "CRYP-2334", "CRYP-637-A10", "CRYP-713-A07", "CRYP-738-A06", "CRYP-790", "DATA-1240-A08", "DATA-2493-A12", "DATA-2510-A07", "DATA-2572", "DATA-3376-A06", "DATA-3649-A14", "DATA-4225-A04", "DATA-4317-A05", "DATA-4666-A04", "GOV-180-A06", "GOV-180-A12", "GOV-2076-A13", "GOV-3110-A02", "INC-946-A11", "LOG-107-A02", "LOG-1861-A06", "MSG-003-A03", "NET-1293-A02", "NET-857-A06", "NET-857-A12", "NET-860-A09", "SEC-052-A06", "SEC-093-A05", "SEC-093-A06", "SEC-2643-A15", "SEC-2738-A06", "SEC-2809", "SEC-2809-A02", "SEC-2809-A05", "SEC-2809-A09", "SEC-3383-A03", "SEC-3740-A03", "SEC-3965-A02", "SEC-3991", "SEC-4292-A12", "SEC-4295", "SEC-4513-A07", "SEC-4560-A03", "SEC-5435-A03", "SEC-5505-A05", "SEC-5767-A01", "SEC-6784-A08", "SEC-6804-A01", "SEC-6804-A02", "SEC-6833-A07", "SEC-6846-A05", "SEC-6925-A10", "SEC-7425-A04", "SEC-7984-A07" ], "member_count": 292, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.83, "source_meta_cluster": "M30", "cluster_size": 13, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" }, "merged_from": [ "secure_credential_deletion" ] }, { "id": "credential_confidentiality_protection", "name": "Vertraulichkeit von Authentifizierungsmaterial", "description": "Authentifizierungsgeheimnisse, -daten und -material sind vor unbefugtem Zugriff, Offenlegung und Speicherung in Logs zu schuetzen.", "tier": "LEGAL_MINIMUM", "family": "authentication", "subdomain": "credential", "applicability": "universal", "evidence_facets": { "governance": true, "capability": true, "evidence": true }, "source_role": "LEGAL_BASIS", "legal_basis": [ { "source": "CRA", "regulation_code": "eu_2024_2847", "anchor": "Annex I (2)(e)", "citation": "protect the confidentiality of stored, transmitted or otherwise processed data" } ], "guidance_basis": [ { "source": "OWASP", "anchor": "ASVS V2", "role": "best_practice" }, { "source": "Sichere Speicherung von Authentifizierungsgeheimnissen", "anchor": "", "role": "implementation_guidance", "merged_from": "credential_storage_hashing" } ], "member_review_units": [ "M35", "M122", "M123", "M15", "M37", "M84" ], "member_controls": [ "ACC-645-A13", "ACC-645-A16", "ACC-690-A02", "AI-1351-A03", "AUTH-036", "AUTH-036-A10", "AUTH-036-A13", "AUTH-1099-A01", "AUTH-1283-A03", "AUTH-1286", "AUTH-1295-A02", "AUTH-1296", "AUTH-1296-A01", "AUTH-1300-A02", "AUTH-1313-A02", "AUTH-1437-A03", "AUTH-1441-A07", "AUTH-1441-A08", "AUTH-1468-A02", "AUTH-148-A11", "AUTH-1524-A03", "AUTH-1529-A10", "AUTH-1535", "AUTH-1535-A06", "AUTH-1627", "AUTH-1634", "AUTH-1634-A01", "AUTH-1640-A02", "AUTH-1646", "AUTH-1669", "AUTH-1669-A01", "AUTH-1669-A02", "AUTH-1693", "AUTH-1693-A01", "AUTH-1694", "AUTH-1694-A01", "AUTH-1694-A02", "AUTH-1721-A01", "AUTH-1734-A02", "AUTH-1747", "AUTH-1817", "AUTH-1819-A02", "AUTH-1820", "AUTH-1836-A02", "AUTH-1858", "AUTH-1865", "AUTH-1865-A01", "AUTH-1865-A08", "AUTH-1877-A04", "AUTH-1915", "AUTH-1915-A01", "AUTH-1919", "AUTH-1949-A06", "AUTH-2167-A01", "AUTH-2317-A02", "AUTH-2317-A06", "AUTH-2333-A03", "AUTH-2375-A05", "AUTH-2416", "AUTH-2416-A05", "AUTH-2416-A08", "AUTH-2419-A06", "AUTH-2423", "AUTH-2423-A04", "AUTH-2425", "AUTH-2430-A01", "AUTH-2466-A08", "AUTH-2466-A11", "AUTH-2486", "AUTH-2553-A12", "AUTH-2650", "AUTH-2650-A01", "AUTH-2793-A01", "AUTH-2805", "AUTH-2805-A01", "AUTH-2805-A02", "AUTH-2805-A03", "AUTH-2805-A04", "AUTH-2805-A05", "AUTH-2850-A02", "AUTH-2850-A04", "AUTH-2875-A02", "AUTH-2886-A04", "AUTH-2921", "AUTH-2922-A06", "AUTH-2923-A01", "AUTH-2930-A07", "AUTH-2933-A04", "AUTH-2935", "AUTH-2935-A08", "AUTH-2937", "AUTH-2937-A05", "AUTH-2940", "AUTH-2945", "AUTH-2953", "AUTH-2956", "AUTH-2974-A03", "AUTH-2975", "AUTH-2995", "AUTH-2996-A05", "AUTH-3010", "AUTH-3013-A10", "AUTH-3016-A14", "AUTH-3017-A07", "AUTH-3018-A05", "AUTH-3024-A03", "AUTH-3074-A01", "AUTH-3151-A04", "AUTH-3255", "AUTH-3255-A02", "AUTH-3258-A02", "AUTH-3258-A05", "AUTH-3279", "AUTH-3305", "AUTH-3425-A03", "AUTH-3430-A01", "AUTH-3430-A02", "AUTH-3550-A02", "AUTH-3597-A01", "AUTH-3643", "AUTH-3645-A07", "AUTH-3652", "AUTH-3652-A01", "AUTH-3652-A02", "AUTH-3652-A03", "AUTH-3652-A04", "AUTH-3652-A09", "AUTH-3672", "AUTH-3751-A02", "AUTH-3751-A04", "AUTH-3865-A07", "AUTH-3906-A14", "AUTH-3908-A04", "AUTH-3929", "AUTH-3955-A07", "AUTH-3958-A01", "AUTH-3958-A06", "AUTH-3984", "AUTH-3984-A03", "AUTH-3987", "AUTH-3987-A02", "AUTH-4050", "AUTH-4121-A02", "AUTH-577-A06", "AUTH-592-A04", "AUTH-625", "AUTH-625-A01", "AUTH-655", "AUTH-655-A01", "AUTH-655-A04", "AUTH-655-A08", "AUTH-655-A15", "AUTH-670", "AUTH-674-A03", "AUTH-674-A04", "AUTH-675-A03", "AUTH-700-A03", "AUTH-710-A02", "AUTH-718", "AUTH-732-A02", "AUTH-732-A03", "AUTH-734-A10", "AUTH-748", "AUTH-748-A02", "AUTH-748-A04", "AUTH-748-A09", "AUTH-750", "AUTH-763", "AUTH-771-A02", "AUTH-783", "AUTH-784-A04", "AUTH-784-A05", "AUTH-784-A06", "AUTH-789", "AUTH-789-A01", "AUTH-818-A08", "AUTH-818-A14", "AUTH-833-A04", "AUTH-833-A09", "AUTH-836-A03", "AUTH-836-A10", "AUTH-836-A14", "AUTH-843-A05", "AUTH-843-A14", "AUTH-843-A23", "AUTH-843-A33", "AUTH-843-A43", "AUTH-843-A50", "AUTH-846-A05", "AUTH-846-A14", "AUTH-846-A24", "AUTH-846-A34", "AUTH-846-A43", "AUTH-849-A02", "AUTH-849-A04", "AUTH-849-A11", "AUTH-849-A13", "AUTH-849-A18", "AUTH-849-A20", "AUTH-849-A35", "AUTH-849-A37", "AUTH-849-A50", "AUTH-850", "AUTH-850-A05", "AUTH-850-A09", "AUTH-850-A15", "AUTH-850-A34", "AUTH-919", "AUTH-925-A02", "AUTH-925-A09", "AUTH-925-A17", "AUTH-934", "AUTH-934-A01", "AUTH-934-A02", "AUTH-934-A03", "AUTH-934-A04", "AUTH-934-A09", "AUTH-934-A10", "AUTH-934-A11", "AUTH-934-A12", "AUTH-934-A18", "AUTH-934-A19", "AUTH-934-A20", "AUTH-934-A21", "AUTH-934-A27", "AUTH-934-A28", "AUTH-934-A29", "AUTH-934-A30", "AUTH-934-A40", "AUTH-934-A41", "AUTH-934-A42", "AUTH-934-A43", "AUTH-987", "AUTH-987-A01", "AUTH-987-A23", "AUTH-987-A24", "COMP-1264", "COMP-1735-A09", "COMP-1745-A03", "COMP-262-A01", "COMP-2876-A05", "COMP-3431-A02", "COMP-3983", "COMP-3983-A13", "CRYP-1124", "CRYP-1124-A01", "CRYP-1124-A04", "CRYP-1124-A08", "CRYP-1134-A05", "CRYP-1159-A02", "CRYP-1239-A01", "CRYP-1255", "CRYP-1267", "CRYP-1267-A02", "CRYP-1271", "CRYP-1336", "CRYP-1336-A02", "CRYP-1336-A06", "CRYP-1421-A02", "CRYP-1424-A03", "CRYP-1434-A03", "CRYP-1458-A06", "CRYP-1460-A04", "CRYP-1475", "CRYP-1702-A03", "CRYP-1712-A01", "CRYP-1732-A01", "CRYP-191-A02", "CRYP-1927", "CRYP-1942-A10", "CRYP-2101-A02", "CRYP-2173-A01", "CRYP-2179", "CRYP-224-A08", "CRYP-2254-A04", "CRYP-2363-A05", "CRYP-780-A02", "CRYP-873", "CRYP-880-A04", "DATA-4027-A02", "DATA-720-A02", "INC-971-A06", "NET-004-A05", "NET-004-A09", "NET-004-A19", "NET-104-A02", "NET-104-A10", "NET-1291-A16", "NET-1293-A07", "NET-1309-A01", "NET-1343-A05", "NET-1471-A01", "NET-149-A01", "NET-149-A11", "NET-1856-A05", "SEC-171-A16", "SEC-171-A34", "SEC-2035-A04", "SEC-2153-A03", "SEC-2809-A04", "SEC-2853-A04", "SEC-3195", "SEC-3223", "SEC-3223-A09", "SEC-3643-A08", "SEC-400-A04", "SEC-400-A05", "SEC-400-A21", "SEC-400-A22", "SEC-4561-A04", "SEC-4966-A07", "SEC-5610-A02", "SEC-5780", "SEC-6107-A02", "SEC-8325" ], "member_count": 315, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.85, "source_meta_cluster": "M122", "cluster_size": 11, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "password_policy", "name": "Passwort-Richtlinien und Mindestanforderungen", "description": "Passwortbasierte Authentifizierung muss Mindestlaenge, Komplexitaet und initiale Vergabe gemaess Standard umsetzen.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "password", "applicability": "conditional:password_based", "evidence_facets": { "governance": true, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "NIST", "anchor": "SP 800-63B 5.1.1", "role": "best_practice" }, { "source": "Keine wissensbasierte Authentifizierung als Primaerfaktor", "anchor": "", "role": "implementation_guidance", "merged_from": "no_kba_primary" } ], "member_review_units": [ "M26", "M33", "M87", "M104", "M128" ], "member_controls": [ "AUTH-001", "AUTH-046", "AUTH-1018-A02", "AUTH-1018-A03", "AUTH-1067", "AUTH-1102-A02", "AUTH-1102-A04", "AUTH-1275", "AUTH-1280", "AUTH-1295-A06", "AUTH-1303-A01", "AUTH-1303-A02", "AUTH-1310-A02", "AUTH-1314", "AUTH-1314-A01", "AUTH-1316", "AUTH-1426-A03", "AUTH-1446-A01", "AUTH-1525", "AUTH-1529-A03", "AUTH-1529-A07", "AUTH-1649-A01", "AUTH-1649-A03", "AUTH-1649-A04", "AUTH-1677-A03", "AUTH-1682-A02", "AUTH-1810-A04", "AUTH-1896", "AUTH-1896-A02", "AUTH-1896-A03", "AUTH-1896-A04", "AUTH-1901-A03", "AUTH-1919", "AUTH-1949-A06", "AUTH-2317-A06", "AUTH-2368-A01", "AUTH-2368-A02", "AUTH-2368-A05", "AUTH-2419-A04", "AUTH-2419-A05", "AUTH-2452-A01", "AUTH-2452-A02", "AUTH-2452-A03", "AUTH-2452-A08", "AUTH-2452-A09", "AUTH-2461", "AUTH-2461-A01", "AUTH-2475-A04", "AUTH-2689", "AUTH-2689-A01", "AUTH-2689-A03", "AUTH-2689-A05", "AUTH-2822-A02", "AUTH-2822-A07", "AUTH-2866-A02", "AUTH-2873-A03", "AUTH-2877", "AUTH-2877-A02", "AUTH-2886-A01", "AUTH-2922-A06", "AUTH-2923-A01", "AUTH-2930-A01", "AUTH-2930-A07", "AUTH-2930-A08", "AUTH-2937-A04", "AUTH-2944-A12", "AUTH-2946-A02", "AUTH-2953", "AUTH-2956-A04", "AUTH-2963-A05", "AUTH-2965-A05", "AUTH-2968-A05", "AUTH-2969-A01", "AUTH-2978-A04", "AUTH-2981-A07", "AUTH-2982-A01", "AUTH-2987", "AUTH-2987-A08", "AUTH-2987-A09", "AUTH-2993", "AUTH-2993-A04", "AUTH-2996-A07", "AUTH-3002-A06", "AUTH-3011", "AUTH-3011-A01", "AUTH-3012", "AUTH-3013-A04", "AUTH-3013-A07", "AUTH-3013-A10", "AUTH-3015", "AUTH-3015-A01", "AUTH-3015-A02", "AUTH-3017-A06", "AUTH-3018", "AUTH-3018-A04", "AUTH-3064-A03", "AUTH-3074-A01", "AUTH-3151-A03", "AUTH-3155-A02", "AUTH-3155-A05", "AUTH-3305-A01", "AUTH-3454-A01", "AUTH-3454-A05", "AUTH-3454-A06", "AUTH-3454-A07", "AUTH-3460", "AUTH-3460-A06", "AUTH-3461", "AUTH-3461-A01", "AUTH-3461-A07", "AUTH-3541-A02", "AUTH-3541-A07", "AUTH-3594", "AUTH-3594-A01", "AUTH-3594-A02", "AUTH-3594-A07", "AUTH-3596-A01", "AUTH-3596-A07", "AUTH-3635-A05", "AUTH-3652-A05", "AUTH-3652-A06", "AUTH-3654-A02", "AUTH-3705-A06", "AUTH-3900", "AUTH-3900-A01", "AUTH-3900-A02", "AUTH-3900-A05", "AUTH-3906-A03", "AUTH-3906-A04", "AUTH-3946-A01", "AUTH-3955-A02", "AUTH-3955-A03", "AUTH-3963-A01", "AUTH-3963-A02", "AUTH-3969", "AUTH-3969-A02", "AUTH-3982-A01", "AUTH-3984-A06", "AUTH-3988-A04", "AUTH-3999-A04", "AUTH-4035-A01", "AUTH-4069-A02", "AUTH-4072-A13", "AUTH-4076", "AUTH-4079-A04", "AUTH-4123-A02", "AUTH-4130-A02", "AUTH-520-A04", "AUTH-538", "AUTH-551", "AUTH-551-A02", "AUTH-559-A17", "AUTH-616-A04", "AUTH-616-A14", "AUTH-616-A17", "AUTH-648", "AUTH-680-A04", "AUTH-750", "AUTH-754-A05", "AUTH-754-A07", "AUTH-754-A12", "AUTH-763-A06", "AUTH-766-A06", "AUTH-769-A07", "AUTH-774-A03", "AUTH-775-A06", "AUTH-803-A02", "AUTH-807-A04", "AUTH-813", "AUTH-825", "AUTH-827", "AUTH-827-A10", "AUTH-831-A03", "AUTH-831-A05", "AUTH-836-A03", "AUTH-836-A10", "AUTH-836-A14", "AUTH-849-A02", "AUTH-849-A11", "AUTH-849-A18", "AUTH-849-A35", "AUTH-849-A50", "AUTH-850-A05", "AUTH-850-A15", "AUTH-850-A34", "AUTH-851-A16", "AUTH-855-A01", "AUTH-855-A16", "AUTH-855-A31", "AUTH-855-A46", "AUTH-855-A47", "AUTH-855-A61", "AUTH-867-A20", "AUTH-939", "AUTH-939-A01", "AUTH-939-A02", "AUTH-939-A09", "AUTH-939-A19", "AUTH-939-A26", "AUTH-939-A31", "AUTH-939-A42", "BND-002-A02", "BND-002-A04", "BND-002-A06", "BND-002-A08", "COMP-1960-A01", "COMP-2780-A04", "COMP-3431-A02", "CRYP-1079-A07", "CRYP-1079-A08", "CRYP-1359-A05", "CRYP-1652-A09", "CRYP-1700-A02", "CRYP-1751-A02", "CRYP-1819-A01", "CRYP-1927-A06", "CRYP-2287", "CRYP-2301-A06", "CRYP-2315-A06", "CRYP-2355-A01", "CRYP-626-A05", "CRYP-876-A06", "DATA-2662-A05", "DATA-3154-A06", "DATA-3613-A02", "DATA-3613-A04", "DATA-3614-A02", "GIA-002-A10", "GOV-3868-A11", "LOG-967", "LOG-967-A01", "LOG-967-A03", "LOG-967-A05", "NET-1243-A05", "NET-1633-A02", "NET-822-A10", "SEC-2445-A01", "SEC-3157-A03", "SEC-3223-A04", "SEC-3643-A07", "SEC-4566-A04", "SEC-4966-A04", "SEC-5640-A04", "SEC-5792-A01", "SEC-5915-A05", "SEC-7793-A05", "SEC-7984", "SEC-7984-A01", "SEC-7984-A04", "SEC-7984-A08", "SEC-8825-A04", "SEC-8825-A05", "SEC-9065-A01" ], "member_count": 253, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.82, "source_meta_cluster": "M87", "cluster_size": 22, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "no_default_credentials", "name": "Keine Standard-/Default-Credentials", "description": "Standardpasswoerter und Default-Credentials muessen geaendert/deaktiviert werden; keine Auslieferung mit fest eingestellten Zugangsdaten.", "tier": "LEGAL_MINIMUM", "family": "authentication", "subdomain": "password", "applicability": "universal", "evidence_facets": { "governance": true, "capability": true, "evidence": true }, "source_role": "LEGAL_BASIS", "legal_basis": [ { "source": "CRA", "regulation_code": "eu_2024_2847", "anchor": "Annex I (2)(a)", "citation": "be made available with a secure by default configuration" } ], "guidance_basis": [], "member_review_units": [ "M104" ], "member_controls": [ "AUTH-3017-A06", "AUTH-3654-A02", "AUTH-3969", "AUTH-4123-A02", "COMP-1960-A01", "CRYP-1079-A07", "NET-822-A10", "SEC-3223-A04", "SEC-4966-A04" ], "member_count": 9, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.8, "source_meta_cluster": "M104", "cluster_size": 9, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "account_lockout_failed_attempts", "name": "Account-Sperrung nach fehlgeschlagenen Versuchen", "description": "Nach wiederholten fehlgeschlagenen Authentifizierungsversuchen sind Lockout-/Rate-Limit-Massnahmen umzusetzen, inkl. biometrischer Versuchszaehlung.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "credential", "applicability": "universal", "evidence_facets": { "governance": true, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "OWASP", "anchor": "ASVS V2.2", "role": "best_practice" } ], "member_review_units": [ "M43", "M33", "M3", "M88" ], "member_controls": [ "ACC-0383-A06", "ACC-0384-A02", "ACC-0384-A03", "ACC-082-A06", "ACC-082-A07", "ACC-082-A15", "ACC-082-A16", "ACC-320", "ACC-320-A01", "ACC-320-A02", "ACC-320-A03", "ACC-320-A04", "ACC-320-A06", "ACC-320-A09", "ACC-320-A10", "ACC-320-A11", "ACC-320-A12", "ACC-320-A13", "ACC-320-A17", "ACC-320-A19", "ACC-320-A20", "ACC-320-A21", "ACC-320-A26", "ACC-320-A28", "ACC-320-A29", "ACC-320-A35", "ACC-320-A36", "ACC-320-A37", "ACC-320-A38", "ACC-320-A41", "ACC-320-A42", "ACC-320-A43", "ACC-320-A44", "ACC-320-A45", "ACC-327-A18", "ACC-327-A60", "ACC-427", "ACC-427-A01", "ACC-427-A02", "ACC-427-A03", "ACC-427-A11", "ACC-427-A12", "ACC-490-A04", "ACC-490-A09", "ACC-499-A05", "ACC-504-A09", "ACC-518-A06", "ACC-567-A10", "ACC-584-A05", "ACC-673-A10", "ACC-741-A03", "ACL-004-A04", "AI-052-A26", "AI-052-A27", "AI-1012-A03", "AI-1012-A04", "AI-1012-A05", "AI-1012-A07", "AI-1027-A07", "AI-1236-A04", "AI-1408-A01", "AI-1417-A06", "AI-1660-A12", "AI-1715-A08", "AI-997-A01", "AUTH-018", "AUTH-018-A18", "AUTH-032", "AUTH-043", "AUTH-045", "AUTH-047-A02", "AUTH-067-A12", "AUTH-088-A01", "AUTH-088-A02", "AUTH-1004-A01", "AUTH-1008", "AUTH-1009-A01", "AUTH-1009-A03", "AUTH-1011-A01", "AUTH-1026", "AUTH-1026-A01", "AUTH-1048-A03", "AUTH-1048-A69", "AUTH-1087-A04", "AUTH-1093-A03", "AUTH-1102-A02", "AUTH-1102-A04", "AUTH-1102-A08", "AUTH-1110-A03", "AUTH-1135-A03", "AUTH-1135-A04", "AUTH-1168-A02", "AUTH-1168-A03", "AUTH-1280", "AUTH-1283-A02", "AUTH-1293", "AUTH-1295-A06", "AUTH-1296-A05", "AUTH-1298-A02", "AUTH-1298-A03", "AUTH-1299-A05", "AUTH-1303-A03", "AUTH-1311-A02", "AUTH-1313-A01", "AUTH-1316", "AUTH-1426-A03", "AUTH-1426-A05", "AUTH-1426-A06", "AUTH-1437", "AUTH-1437-A01", "AUTH-1437-A02", "AUTH-1437-A06", "AUTH-1445-A04", "AUTH-1448-A01", "AUTH-1455", "AUTH-1455-A01", "AUTH-1455-A07", "AUTH-1463-A02", "AUTH-1464-A04", "AUTH-1464-A05", "AUTH-1464-A07", "AUTH-1466-A04", "AUTH-1466-A08", "AUTH-1522-A04", "AUTH-1524", "AUTH-1524-A01", "AUTH-1524-A02", "AUTH-1525", "AUTH-1529-A03", "AUTH-1529-A06", "AUTH-1529-A07", "AUTH-1535-A02", "AUTH-1538-A01", "AUTH-1538-A10", "AUTH-1576-A01", "AUTH-1579-A01", "AUTH-1623-A04", "AUTH-1623-A07", "AUTH-1623-A08", "AUTH-1624-A11", "AUTH-1633-A01", "AUTH-1634-A06", "AUTH-1635-A06", "AUTH-1640-A01", "AUTH-1640-A03", "AUTH-1649-A04", "AUTH-1652-A07", "AUTH-1654", "AUTH-1654-A01", "AUTH-1654-A02", "AUTH-1654-A03", "AUTH-1654-A05", "AUTH-1666-A04", "AUTH-1669-A07", "AUTH-1673-A08", "AUTH-1675-A07", "AUTH-1677-A03", "AUTH-1678-A02", "AUTH-1678-A07", "AUTH-1682-A02", "AUTH-1694-A06", "AUTH-1695", "AUTH-1701-A09", "AUTH-1702-A03", "AUTH-1706-A05", "AUTH-1706-A09", "AUTH-1709-A05", "AUTH-1711-A02", "AUTH-1711-A04", "AUTH-1711-A07", "AUTH-1711-A10", "AUTH-1720-A08", "AUTH-1721-A03", "AUTH-1752-A05", "AUTH-1752-A10", "AUTH-1753-A05", "AUTH-1753-A07", "AUTH-1806", "AUTH-1808-A07", "AUTH-1809", "AUTH-1809-A02", "AUTH-1809-A06", "AUTH-1810", "AUTH-1810-A01", "AUTH-1810-A04", "AUTH-1810-A06", "AUTH-1812", "AUTH-1812-A01", "AUTH-1812-A02", "AUTH-1814-A01", "AUTH-1820-A04", "AUTH-1820-A06", "AUTH-1823", "AUTH-1823-A01", "AUTH-1823-A02", "AUTH-1827-A04", "AUTH-1829-A01", "AUTH-1830-A02", "AUTH-1830-A03", "AUTH-1830-A06", "AUTH-1830-A08", "AUTH-1831-A05", "AUTH-1835-A08", "AUTH-1839-A05", "AUTH-1843-A07", "AUTH-1843-A08", "AUTH-1843-A09", "AUTH-1859", "AUTH-1877-A06", "AUTH-1877-A08", "AUTH-1896-A04", "AUTH-1909-A02", "AUTH-1909-A07", "AUTH-1909-A08", "AUTH-1910-A11", "AUTH-1911-A01", "AUTH-1911-A05", "AUTH-1913", "AUTH-1915-A03", "AUTH-1915-A08", "AUTH-1916-A01", "AUTH-1916-A05", "AUTH-1917-A04", "AUTH-1917-A08", "AUTH-1931-A05", "AUTH-1933", "AUTH-1935", "AUTH-1936-A11", "AUTH-1943-A07", "AUTH-1944", "AUTH-1944-A01", "AUTH-1945-A07", "AUTH-1945-A09", "AUTH-1946-A04", "AUTH-1947-A07", "AUTH-1952", "AUTH-1952-A02", "AUTH-1952-A03", "AUTH-1952-A05", "AUTH-1952-A06", "AUTH-1952-A07", "AUTH-1952-A08", "AUTH-1959", "AUTH-1959-A02", "AUTH-1959-A04", "AUTH-1959-A05", "AUTH-1959-A06", "AUTH-1959-A08", "AUTH-2280", "AUTH-2280-A01", "AUTH-2331-A08", "AUTH-2333-A01", "AUTH-2333-A02", "AUTH-2338-A04", "AUTH-2338-A06", "AUTH-2345-A03", "AUTH-2345-A04", "AUTH-2368-A03", "AUTH-2368-A05", "AUTH-2372-A01", "AUTH-2382-A01", "AUTH-2399", "AUTH-2399-A04", "AUTH-2403", "AUTH-2403-A03", "AUTH-2403-A06", "AUTH-2405-A05", "AUTH-2411", "AUTH-2413", "AUTH-2413-A01", "AUTH-2413-A03", "AUTH-2416-A01", "AUTH-2416-A03", "AUTH-2417-A04", "AUTH-2417-A11", "AUTH-2417-A13", "AUTH-2419-A04", "AUTH-2419-A05", "AUTH-2421-A03", "AUTH-2444-A01", "AUTH-2444-A07", "AUTH-2444-A08", "AUTH-2451-A04", "AUTH-2464-A03", "AUTH-2660-A02", "AUTH-2678", "AUTH-2678-A01", "AUTH-2779", "AUTH-2781-A03", "AUTH-2801", "AUTH-2801-A03", "AUTH-2817", "AUTH-2851", "AUTH-2852", "AUTH-2866-A02", "AUTH-2866-A03", "AUTH-2873-A01", "AUTH-2873-A05", "AUTH-2873-A07", "AUTH-2875-A01", "AUTH-2877", "AUTH-2877-A01", "AUTH-2877-A02", "AUTH-2877-A05", "AUTH-2880-A01", "AUTH-2883", "AUTH-2883-A01", "AUTH-2883-A02", "AUTH-2906-A01", "AUTH-2906-A08", "AUTH-2921-A12", "AUTH-2935-A06", "AUTH-2939-A04", "AUTH-2943-A01", "AUTH-2943-A08", "AUTH-2946", "AUTH-2946-A02", "AUTH-2949-A06", "AUTH-2949-A09", "AUTH-2958-A07", "AUTH-2959-A03", "AUTH-2960-A08", "AUTH-2963-A05", "AUTH-2964", "AUTH-2966-A04", "AUTH-2967-A05", "AUTH-2970-A02", "AUTH-2970-A03", "AUTH-2970-A05", "AUTH-2970-A07", "AUTH-2970-A08", "AUTH-2980", "AUTH-2981-A08", "AUTH-2984", "AUTH-2987", "AUTH-2987-A06", "AUTH-2987-A08", "AUTH-2989-A01", "AUTH-2993-A03", "AUTH-2993-A04", "AUTH-2996-A07", "AUTH-3002-A04", "AUTH-3002-A06", "AUTH-3007-A03", "AUTH-3008-A02", "AUTH-3011", "AUTH-3011-A06", "AUTH-3013-A02", "AUTH-3016", "AUTH-3016-A15", "AUTH-3016-A16", "AUTH-3018", "AUTH-3021-A04", "AUTH-3025", "AUTH-3045", "AUTH-3045-A01", "AUTH-3045-A02", "AUTH-3045-A03", "AUTH-3064-A03", "AUTH-3065-A02", "AUTH-3065-A03", "AUTH-3065-A04", "AUTH-3071-A01", "AUTH-3071-A04", "AUTH-3071-A09", "AUTH-3073", "AUTH-3073-A02", "AUTH-3073-A03", "AUTH-3073-A05", "AUTH-3075-A01", "AUTH-3075-A02", "AUTH-3150", "AUTH-3150-A01", "AUTH-3150-A04", "AUTH-3150-A07", "AUTH-3150-A09", "AUTH-3151", "AUTH-3151-A01", "AUTH-3151-A05", "AUTH-3151-A06", "AUTH-3151-A07", "AUTH-3151-A10", "AUTH-3151-A11", "AUTH-3154", "AUTH-3154-A01", "AUTH-3154-A02", "AUTH-3154-A08", "AUTH-3155", "AUTH-3155-A04", "AUTH-3155-A05", "AUTH-3161-A04", "AUTH-3164-A02", "AUTH-3164-A05", "AUTH-3164-A07", "AUTH-3164-A12", "AUTH-3166-A01", "AUTH-3166-A02", "AUTH-3170", "AUTH-3170-A01", "AUTH-3170-A02", "AUTH-3230-A01", "AUTH-3279-A03", "AUTH-3305-A04", "AUTH-3314-A01", "AUTH-3314-A02", "AUTH-3314-A03", "AUTH-3394-A04", "AUTH-3396-A04", "AUTH-3399", "AUTH-3399-A03", "AUTH-3454-A01", "AUTH-3454-A05", "AUTH-3454-A06", "AUTH-3454-A07", "AUTH-3460-A02", "AUTH-3460-A05", "AUTH-3460-A07", "AUTH-3460-A08", "AUTH-3461-A02", "AUTH-3461-A06", "AUTH-3541-A05", "AUTH-3545", "AUTH-3547-A01", "AUTH-3548-A02", "AUTH-3549", "AUTH-3552-A03", "AUTH-3552-A05", "AUTH-3554-A03", "AUTH-3556-A03", "AUTH-3558-A04", "AUTH-3562-A04", "AUTH-3595-A01", "AUTH-3596-A06", "AUTH-3597", "AUTH-3597-A03", "AUTH-3597-A04", "AUTH-3597-A05", "AUTH-3599-A02", "AUTH-3624", "AUTH-3624-A01", "AUTH-3624-A02", "AUTH-3633-A02", "AUTH-3641", "AUTH-3641-A01", "AUTH-3641-A08", "AUTH-3656-A08", "AUTH-3656-A09", "AUTH-3656-A12", "AUTH-3656-A13", "AUTH-3677-A06", "AUTH-3825-A01", "AUTH-3825-A06", "AUTH-384-A07", "AUTH-384-A10", "AUTH-3887-A07", "AUTH-3922", "AUTH-3935", "AUTH-3935-A10", "AUTH-3935-A11", "AUTH-3935-A12", "AUTH-3935-A13", "AUTH-3935-A14", "AUTH-3935-A15", "AUTH-3935-A16", "AUTH-3935-A17", "AUTH-3935-A18", "AUTH-3935-A19", "AUTH-3951-A06", "AUTH-3951-A07", "AUTH-3955-A01", "AUTH-3955-A02", "AUTH-3955-A03", "AUTH-3960-A02", "AUTH-3960-A03", "AUTH-3960-A04", "AUTH-3960-A05", "AUTH-3964-A06", "AUTH-3984-A06", "AUTH-3988-A04", "AUTH-3993-A01", "AUTH-3993-A03", "AUTH-3999-A04", "AUTH-4007-A06", "AUTH-4028-A05", "AUTH-4031-A07", "AUTH-4043", "AUTH-4043-A06", "AUTH-4043-A08", "AUTH-4054-A07", "AUTH-4130-A02", "AUTH-4135", "AUTH-4135-A03", "AUTH-497", "AUTH-497-A03", "AUTH-505-A04", "AUTH-530-A01", "AUTH-530-A05", "AUTH-530-A08", "AUTH-530-A11", "AUTH-532-A02", "AUTH-538-A06", "AUTH-548", "AUTH-548-A01", "AUTH-548-A03", "AUTH-559", "AUTH-559-A01", "AUTH-559-A03", "AUTH-559-A05", "AUTH-559-A09", "AUTH-559-A12", "AUTH-559-A17", "AUTH-577", "AUTH-577-A05", "AUTH-582", "AUTH-582-A01", "AUTH-584", "AUTH-584-A01", "AUTH-584-A02", "AUTH-584-A08", "AUTH-584-A09", "AUTH-586-A03", "AUTH-586-A04", "AUTH-592", "AUTH-592-A02", "AUTH-595", "AUTH-595-A05", "AUTH-610", "AUTH-610-A06", "AUTH-615", "AUTH-615-A01", "AUTH-615-A02", "AUTH-615-A03", "AUTH-615-A04", "AUTH-615-A05", "AUTH-616", "AUTH-616-A01", "AUTH-616-A02", "AUTH-616-A03", "AUTH-616-A04", "AUTH-616-A05", "AUTH-616-A06", "AUTH-616-A12", "AUTH-616-A13", "AUTH-616-A14", "AUTH-617", "AUTH-623", "AUTH-623-A01", "AUTH-623-A02", "AUTH-623-A03", "AUTH-623-A04", "AUTH-623-A05", "AUTH-623-A06", "AUTH-637-A08", "AUTH-637-A09", "AUTH-637-A30", "AUTH-646-A04", "AUTH-655-A10", "AUTH-655-A11", "AUTH-674", "AUTH-674-A02", "AUTH-680-A04", "AUTH-694", "AUTH-694-A02", "AUTH-694-A03", "AUTH-700-A02", "AUTH-710-A03", "AUTH-710-A04", "AUTH-710-A05", "AUTH-732-A04", "AUTH-732-A05", "AUTH-745", "AUTH-745-A01", "AUTH-745-A05", "AUTH-748-A05", "AUTH-748-A06", "AUTH-748-A10", "AUTH-748-A11", "AUTH-752", "AUTH-752-A01", "AUTH-752-A07", "AUTH-754-A05", "AUTH-754-A07", "AUTH-754-A12", "AUTH-766-A06", "AUTH-769-A07", "AUTH-775-A10", "AUTH-782-A06", "AUTH-784-A03", "AUTH-785", "AUTH-785-A01", "AUTH-795-A02", "AUTH-803-A05", "AUTH-803-A07", "AUTH-804-A06", "AUTH-818-A02", "AUTH-822-A04", "AUTH-822-A05", "AUTH-825-A05", "AUTH-828-A05", "AUTH-828-A09", "AUTH-828-A10", "AUTH-831-A03", "AUTH-831-A05", "AUTH-836-A04", "AUTH-836-A05", "AUTH-836-A07", "AUTH-836-A11", "AUTH-836-A16", "AUTH-838-A10", "AUTH-838-A11", "AUTH-838-A17", "AUTH-838-A18", "AUTH-838-A26", "AUTH-838-A27", "AUTH-838-A36", "AUTH-838-A37", "AUTH-838-A44", "AUTH-838-A45", "AUTH-844-A03", "AUTH-844-A12", "AUTH-844-A20", "AUTH-844-A27", "AUTH-844-A36", "AUTH-845-A01", "AUTH-845-A06", "AUTH-845-A13", "AUTH-845-A18", "AUTH-845-A24", "AUTH-845-A27", "AUTH-845-A38", "AUTH-845-A45", "AUTH-845-A50", "AUTH-845-A54", "AUTH-846-A03", "AUTH-846-A12", "AUTH-846-A22", "AUTH-846-A32", "AUTH-846-A41", "AUTH-850-A19", "AUTH-850-A29", "AUTH-850-A38", "AUTH-850-A46", "AUTH-851-A01", "AUTH-851-A02", "AUTH-851-A16", "AUTH-851-A46", "AUTH-867-A20", "AUTH-885-A03", "AUTH-885-A10", "AUTH-885-A17", "AUTH-885-A22", "AUTH-885-A31", "AUTH-888-A30", "AUTH-888-A37", "AUTH-894-A06", "AUTH-894-A11", "AUTH-894-A12", "AUTH-902-A01", "AUTH-902-A11", "AUTH-902-A17", "AUTH-905-A04", "AUTH-905-A09", "AUTH-905-A14", "AUTH-905-A17", "AUTH-905-A22", "AUTH-909-A02", "AUTH-909-A12", "AUTH-909-A22", "AUTH-909-A32", "AUTH-909-A42", "AUTH-913-A05", "AUTH-917", "AUTH-917-A01", "AUTH-917-A04", "AUTH-917-A05", "AUTH-917-A06", "AUTH-917-A09", "AUTH-917-A10", "AUTH-917-A11", "AUTH-917-A14", "AUTH-917-A15", "AUTH-917-A16", "AUTH-917-A17", "AUTH-917-A20", "AUTH-917-A21", "AUTH-917-A22", "AUTH-917-A24", "AUTH-917-A25", "AUTH-917-A26", "AUTH-922-A02", "AUTH-922-A08", "AUTH-928-A07", "AUTH-928-A13", "AUTH-928-A19", "AUTH-928-A25", "AUTH-928-A30", "AUTH-932", "AUTH-937-A01", "AUTH-937-A08", "AUTH-937-A15", "AUTH-937-A22", "AUTH-937-A29", "AUTH-938-A01", "AUTH-938-A02", "AUTH-938-A03", "AUTH-938-A08", "AUTH-938-A09", "AUTH-938-A10", "AUTH-938-A13", "AUTH-938-A14", "AUTH-938-A19", "AUTH-938-A20", "AUTH-938-A21", "AUTH-938-A26", "AUTH-938-A27", "AUTH-938-A28", "AUTH-938-A36", "AUTH-938-A37", "AUTH-938-A38", "AUTH-941-A04", "AUTH-941-A05", "AUTH-941-A10", "AUTH-941-A11", "AUTH-941-A17", "AUTH-941-A18", "AUTH-941-A23", "AUTH-941-A24", "AUTH-953", "AUTH-953-A06", "AUTH-954-A15", "AUTH-960", "AUTH-974-A07", "AUTH-976-A07", "AUTH-988-A09", "AUTH-988-A20", "AUTH-989-A18", "AUTH-995-A05", "AUTH-995-A85", "AUTH-996-A04", "AUTH-996-A17", "BND-002-A02", "BND-002-A04", "BND-002-A06", "BND-002-A08", "COMP-1264-A01", "COMP-1264-A02", "COMP-1264-A05", "COMP-1883-A03", "COMP-1904-A04", "COMP-1904-A05", "COMP-1948", "COMP-1948-A02", "COMP-1960-A06", "COMP-1960-A09", "COMP-2029-A04", "COMP-2131-A09", "COMP-2639-A04", "COMP-3435-A05", "COMP-3602", "COMP-3602-A01", "COMP-3602-A08", "COMP-3602-A10", "COMP-3733-A03", "COMP-3983-A02", "COMP-3983-A04", "COMP-3983-A12", "CRYP-1097-A09", "CRYP-1124-A05", "CRYP-1141-A09", "CRYP-1306-A07", "CRYP-1386-A08", "CRYP-1391-A05", "CRYP-1393-A03", "CRYP-1466-A03", "CRYP-1466-A05", "CRYP-1712-A15", "CRYP-1864", "CRYP-1864-A02", "CRYP-191", "CRYP-1983-A01", "CRYP-2287", "CRYP-2287-A01", "CRYP-2287-A12", "CRYP-2301-A06", "CRYP-447-A16", "CRYP-447-A20", "CRYP-450-A05", "CRYP-450-A06", "CRYP-450-A40", "CRYP-450-A52", "CRYP-450-A53", "CRYP-626", "CRYP-626-A05", "CRYP-671-A01", "CRYP-671-A02", "CRYP-876-A06", "DATA-1191-A10", "DATA-1257-A05", "DATA-1257-A09", "DATA-1801-A06", "DATA-260-A02", "DATA-260-A08", "DATA-2607-A05", "DATA-2648-A01", "DATA-2662-A05", "DATA-2663-A04", "DATA-3292-A01", "DATA-3401-A01", "DATA-3613-A01", "DATA-3754-A03", "DATA-598-A05", "DATA-598-A06", "DATA-972-A06", "DATA-972-A12", "FIN-1223-A06", "GOV-1562-A05", "GOV-1700-A01", "GOV-1732-A01", "GOV-1733-A04", "GOV-3902-A01", "GOV-413-A18", "GOV-519", "GOV-519-A11", "GOV-519-A35", "GOV-520-A40", "IAM-008", "IDA-008-A01", "IDA-008-A04", "IDF-004-A02", "IDF-010", "IDF-010-A01", "INC-946-A06", "LGM-001-A09", "LOG-053-A07", "LOG-1742-A05", "LOG-1742-A08", "LOG-1742-A13", "LOG-1748-A01", "LOG-1767-A02", "LOG-705-A01", "LOG-735-A17", "LOG-735-A18", "LOG-745-A44", "LOG-745-A54", "LOG-774-A01", "LOG-774-A15", "LOG-774-A22", "LOG-774-A29", "MIA-001", "NET-1014-A03", "NET-1014-A04", "NET-1633-A02", "NET-351", "NET-351-A01", "NET-351-A02", "NET-351-A06", "NET-351-A07", "NET-391", "NET-391-A01", "NET-391-A08", "NET-405", "NET-405-A03", "NET-405-A08", "NET-405-A09", "NET-506-A15", "NET-506-A60", "NET-794-A06", "NET-806-A02", "NET-857-A04", "NET-857-A05", "NET-901-A04", "NET-920-A02", "NET-938-A10", "NET-965", "NET-980-A07", "PFI-001-A02", "SEC-082-A06", "SEC-1085", "SEC-1144-A03", "SEC-1144-A28", "SEC-1144-A42", "SEC-1144-A56", "SEC-1144-A70", "SEC-1146-A02", "SEC-1146-A07", "SEC-1146-A54", "SEC-1146-A59", "SEC-1153-A12", "SEC-2445-A01", "SEC-2635-A03", "SEC-2662-A07", "SEC-2662-A13", "SEC-2798", "SEC-2818-A05", "SEC-2841-A03", "SEC-2845-A09", "SEC-2899-A04", "SEC-2899-A06", "SEC-3195-A04", "SEC-3383-A08", "SEC-3406", "SEC-3732-A08", "SEC-3842-A02", "SEC-3935-A02", "SEC-4028-A03", "SEC-4076-A02", "SEC-4217", "SEC-4292-A08", "SEC-4509", "SEC-4513-A04", "SEC-4655-A03", "SEC-4655-A04", "SEC-5595-A13", "SEC-5792-A03", "SEC-5792-A04", "SEC-6770", "SEC-6784-A10", "SEC-6830-A05", "SEC-7963-A03", "SEC-7963-A04", "SEC-7965-A03", "SEC-7994-A06", "SEC-8121-A05", "SEC-8138-A03", "SEC-8295-A01", "SEC-8334-A06", "SEC-8825-A05", "SEC-9212-A01", "SEC-9212-A02" ], "member_count": 929, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.82, "source_meta_cluster": "M43", "cluster_size": 95, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" }, "evidence_merged_from": [ "auth_anomaly_detection", "auth_failure_logging" ] }, { "id": "server_side_validation", "name": "Serverseitige Validierung von Authentifizierung", "description": "Authentifizierungsentscheidungen sind serverseitig zu validieren; clientseitige/nicht vertrauenswuerdige Validierung ist unzulaessig.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "credential", "applicability": "universal", "evidence_facets": { "governance": false, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "OWASP", "anchor": "ASVS V1.2", "role": "best_practice" } ], "member_review_units": [ "M15", "M32", "M123" ], "member_controls": [ "ACC-645-A13", "ACC-645-A16", "ACC-690-A02", "AI-1351-A03", "AUTH-036", "AUTH-036-A10", "AUTH-036-A13", "AUTH-1099-A01", "AUTH-1099-A06", "AUTH-1286", "AUTH-1296", "AUTH-1296-A01", "AUTH-1306-A06", "AUTH-1529-A10", "AUTH-1535", "AUTH-1535-A06", "AUTH-1627-A15", "AUTH-1640-A02", "AUTH-1659-A01", "AUTH-1669", "AUTH-1669-A02", "AUTH-1694", "AUTH-1694-A01", "AUTH-1694-A02", "AUTH-1701-A01", "AUTH-1701-A08", "AUTH-1748-A05", "AUTH-1752-A04", "AUTH-1758-A01", "AUTH-1758-A05", "AUTH-1819-A02", "AUTH-1820", "AUTH-1830-A01", "AUTH-1836-A02", "AUTH-1864-A09", "AUTH-1877-A04", "AUTH-1918-A07", "AUTH-1931-A07", "AUTH-2167-A01", "AUTH-2333-A03", "AUTH-2466-A11", "AUTH-2486", "AUTH-2650", "AUTH-2650-A01", "AUTH-2678-A11", "AUTH-2805", "AUTH-2805-A01", "AUTH-2805-A02", "AUTH-2805-A03", "AUTH-2805-A04", "AUTH-2805-A05", "AUTH-2850-A02", "AUTH-2883-A09", "AUTH-2886-A04", "AUTH-2886-A06", "AUTH-2912-A14", "AUTH-2937", "AUTH-2940", "AUTH-2952", "AUTH-2974-A03", "AUTH-2986-A02", "AUTH-2986-A06", "AUTH-3010", "AUTH-3151-A04", "AUTH-3258-A05", "AUTH-3279", "AUTH-3452-A04", "AUTH-3552-A02", "AUTH-3639", "AUTH-3643", "AUTH-3645-A07", "AUTH-3672", "AUTH-3751-A02", "AUTH-3906-A14", "AUTH-3929", "AUTH-3984", "AUTH-3984-A03", "AUTH-674-A04", "AUTH-675-A03", "AUTH-732-A02", "AUTH-732-A03", "AUTH-734-A10", "AUTH-748-A04", "AUTH-748-A09", "AUTH-771-A02", "AUTH-794", "AUTH-794-A02", "AUTH-794-A08", "AUTH-833-A04", "AUTH-833-A09", "AUTH-836-A13", "AUTH-837-A14", "AUTH-843-A05", "AUTH-843-A14", "AUTH-843-A23", "AUTH-843-A33", "AUTH-843-A43", "AUTH-843-A50", "AUTH-846-A05", "AUTH-846-A06", "AUTH-846-A14", "AUTH-846-A15", "AUTH-846-A24", "AUTH-846-A25", "AUTH-846-A34", "AUTH-846-A35", "AUTH-846-A43", "AUTH-846-A44", "AUTH-849-A04", "AUTH-849-A08", "AUTH-849-A09", "AUTH-849-A13", "AUTH-849-A20", "AUTH-849-A24", "AUTH-849-A25", "AUTH-849-A29", "AUTH-849-A30", "AUTH-849-A37", "AUTH-849-A41", "AUTH-849-A42", "AUTH-849-A56", "AUTH-849-A57", "AUTH-850-A09", "AUTH-915-A20", "AUTH-915-A26", "AUTH-934", "AUTH-934-A01", "AUTH-934-A02", "AUTH-934-A03", "AUTH-934-A04", "AUTH-934-A09", "AUTH-934-A10", "AUTH-934-A11", "AUTH-934-A12", "AUTH-934-A18", "AUTH-934-A19", "AUTH-934-A20", "AUTH-934-A21", "AUTH-934-A27", "AUTH-934-A28", "AUTH-934-A29", "AUTH-934-A30", "AUTH-934-A40", "AUTH-934-A41", "AUTH-934-A42", "AUTH-934-A43", "CRYP-1124", "CRYP-1124-A01", "CRYP-1124-A08", "CRYP-1239-A01", "CRYP-1460-A04", "CRYP-1927", "CRYP-2179", "CRYP-2179-A10", "CRYP-2254-A04", "DATA-3649-A13", "DATA-720-A02", "IAM-001-A07", "IAM-001-A11", "INC-1154-A05", "INC-971-A06", "NET-887-A09", "SEC-3195", "SEC-400-A04", "SEC-400-A05", "SEC-400-A21", "SEC-400-A22", "SEC-7963-A07", "SEC-8334-A13" ], "member_count": 169, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.78, "source_meta_cluster": "M15", "cluster_size": 83, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "session_binding_management", "name": "Sitzungsbindung und Session-Management", "description": "Nach erfolgreicher Authentifizierung sind Sessions sicher zu binden, neue Session-IDs zu generieren und sicher zu verwalten.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "session", "applicability": "universal", "evidence_facets": { "governance": false, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "OWASP", "anchor": "ASVS V3", "role": "best_practice" } ], "member_review_units": [ "M25", "M11", "M57", "M71", "M87", "M95", "M103", "M105" ], "member_controls": [ "ACC-567", "ACC-567-A01", "AUT-005", "AUT-005-A05", "AUTH-1058", "AUTH-1058-A01", "AUTH-116-A01", "AUTH-116-A12", "AUTH-1300-A03", "AUTH-1634-A03", "AUTH-1638-A01", "AUTH-1645-A03", "AUTH-1645-A05", "AUTH-1669-A08", "AUTH-1684-A04", "AUTH-1688-A06", "AUTH-1701", "AUTH-1701-A02", "AUTH-1701-A05", "AUTH-1711", "AUTH-1711-A01", "AUTH-1711-A03", "AUTH-1711-A05", "AUTH-1716-A01", "AUTH-1720", "AUTH-1720-A02", "AUTH-1721-A02", "AUTH-1745-A01", "AUTH-1748", "AUTH-1748-A01", "AUTH-1750-A01", "AUTH-1752", "AUTH-1806-A04", "AUTH-1813-A08", "AUTH-1822-A02", "AUTH-1830-A04", "AUTH-1843-A01", "AUTH-1914", "AUTH-1914-A02", "AUTH-1914-A04", "AUTH-1917-A01", "AUTH-1919", "AUTH-1931", "AUTH-1931-A01", "AUTH-1931-A02", "AUTH-1932-A08", "AUTH-1940-A05", "AUTH-1948-A01", "AUTH-1949-A06", "AUTH-2315", "AUTH-2315-A03", "AUTH-2316-A01", "AUTH-2316-A02", "AUTH-2317-A03", "AUTH-2317-A06", "AUTH-2322-A01", "AUTH-2338-A01", "AUTH-2338-A05", "AUTH-2548", "AUTH-2551", "AUTH-2553-A04", "AUTH-2883-A04", "AUTH-2922-A06", "AUTH-2923-A01", "AUTH-2924", "AUTH-2930-A07", "AUTH-2933", "AUTH-2953", "AUTH-2964-A05", "AUTH-2988", "AUTH-2988-A01", "AUTH-2989-A03", "AUTH-2994", "AUTH-2994-A04", "AUTH-2996-A03", "AUTH-3007-A08", "AUTH-3013-A10", "AUTH-3014", "AUTH-3016-A08", "AUTH-3020-A01", "AUTH-3023-A05", "AUTH-3064", "AUTH-3064-A01", "AUTH-3074", "AUTH-3074-A01", "AUTH-3074-A05", "AUTH-3258-A09", "AUTH-3279-A04", "AUTH-3284-A01", "AUTH-3284-A05", "AUTH-3286-A02", "AUTH-3286-A05", "AUTH-3457", "AUTH-3543-A01", "AUTH-3545-A04", "AUTH-3562-A01", "AUTH-3599", "AUTH-3645", "AUTH-3646", "AUTH-3751", "AUTH-4127", "AUTH-606", "AUTH-700", "AUTH-738", "AUTH-738-A04", "AUTH-750", "AUTH-799-A10", "AUTH-799-A11", "AUTH-815", "AUTH-836-A03", "AUTH-836-A10", "AUTH-836-A14", "AUTH-845-A04", "AUTH-845-A05", "AUTH-845-A17", "AUTH-845-A36", "AUTH-845-A37", "AUTH-845-A48", "AUTH-845-A49", "AUTH-845-A52", "AUTH-845-A53", "AUTH-849-A02", "AUTH-849-A11", "AUTH-849-A18", "AUTH-849-A35", "AUTH-849-A50", "AUTH-850-A05", "AUTH-850-A15", "AUTH-850-A34", "AUTH-855-A02", "AUTH-855-A17", "AUTH-855-A32", "AUTH-855-A48", "AUTH-855-A62", "AUTH-893-A10", "AUTH-893-A22", "AUTH-949-A03", "AUTH-949-A30", "AUTH-951", "AUTH-973-A04", "AUTH-974-A08", "AVL-003-A06", "COMP-1904", "COMP-1960-A04", "COMP-3313-A03", "COMP-3421-A13", "COMP-3431-A02", "COMP-3981-A05", "CRYP-1269", "CRYP-1269-A01", "CRYP-1269-A02", "CRYP-1288-A04", "CRYP-1394-A03", "CRYP-1433-A06", "CRYP-1433-A08", "CRYP-1533", "CRYP-1533-A02", "CRYP-1533-A03", "CRYP-447-A01", "CRYP-447-A17", "CRYP-723-A09", "CRYP-948-A05", "DATA-1007-A02", "DATA-1007-A09", "DATA-1007-A11", "DATA-1191-A02", "DATA-1801", "DATA-259", "DATA-3948", "INC-246", "INC-246-A01", "INC-246-A02", "INC-246-A04", "NET-1345-A02", "NET-405-A02", "NET-405-A07", "SEC-1223-A05", "SEC-2809-A08", "SEC-3683-A05", "SEC-4021-A03", "SEC-5610", "SEC-6775", "SEC-6778", "SEC-6846-A03", "SEC-8815" ], "member_count": 185, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.83, "source_meta_cluster": "M25", "cluster_size": 16, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "reauth_after_inactivity", "name": "Neuauthentifizierung nach Inaktivitaet/Timeout", "description": "Nach Inaktivitaetsdauer, Grace-Period oder Netzwerkortwechsel ist eine Neuauthentifizierung zu erzwingen.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "session", "applicability": "universal", "evidence_facets": { "governance": false, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "NIST", "anchor": "SP 800-63B 4.3", "role": "best_practice" } ], "member_review_units": [ "M33", "M13", "M158", "M112" ], "member_controls": [ "ACC-584-A05", "AUTH-047-A02", "AUTH-1093-A03", "AUTH-1102-A02", "AUTH-1102-A04", "AUTH-1135-A03", "AUTH-1135-A04", "AUTH-1168-A02", "AUTH-1168-A03", "AUTH-1280", "AUTH-1295-A06", "AUTH-1299-A05", "AUTH-1316", "AUTH-1426-A03", "AUTH-1522-A04", "AUTH-1525", "AUTH-1529-A03", "AUTH-1529-A07", "AUTH-1640-A01", "AUTH-1649-A04", "AUTH-1677-A03", "AUTH-1682-A02", "AUTH-1806", "AUTH-1810-A04", "AUTH-1896-A04", "AUTH-2338-A04", "AUTH-2368-A05", "AUTH-2411", "AUTH-2413", "AUTH-2413-A01", "AUTH-2419-A04", "AUTH-2419-A05", "AUTH-2421-A03", "AUTH-2444-A08", "AUTH-2660-A02", "AUTH-2866-A02", "AUTH-2875-A01", "AUTH-2877", "AUTH-2877-A02", "AUTH-2943-A01", "AUTH-2946-A02", "AUTH-2963-A05", "AUTH-2987", "AUTH-2987-A08", "AUTH-2993-A04", "AUTH-2996-A07", "AUTH-3002-A06", "AUTH-3007-A03", "AUTH-3011", "AUTH-3011-A06", "AUTH-3016", "AUTH-3018", "AUTH-3064-A03", "AUTH-3155-A05", "AUTH-3334", "AUTH-3334-A05", "AUTH-3454-A01", "AUTH-3454-A05", "AUTH-3454-A06", "AUTH-3454-A07", "AUTH-3545", "AUTH-3955-A02", "AUTH-3955-A03", "AUTH-3984-A06", "AUTH-3988-A04", "AUTH-3999-A04", "AUTH-4028-A05", "AUTH-4130-A02", "AUTH-532-A02", "AUTH-559-A17", "AUTH-586-A03", "AUTH-586-A04", "AUTH-616-A04", "AUTH-616-A14", "AUTH-680-A04", "AUTH-754-A05", "AUTH-754-A07", "AUTH-754-A12", "AUTH-766-A06", "AUTH-769-A07", "AUTH-782-A06", "AUTH-795-A02", "AUTH-831-A03", "AUTH-831-A05", "AUTH-845-A06", "AUTH-845-A18", "AUTH-845-A38", "AUTH-845-A50", "AUTH-845-A54", "AUTH-850-A19", "AUTH-850-A29", "AUTH-850-A38", "AUTH-850-A46", "AUTH-851-A16", "AUTH-867-A20", "AUTH-989-A22", "AUTH-995-A05", "AUTH-995-A85", "AUTH-996-A04", "AUTH-996-A17", "BND-002-A02", "BND-002-A04", "BND-002-A06", "BND-002-A08", "COMP-1948", "COMP-1948-A02", "CRYP-1141-A09", "CRYP-191", "CRYP-2287", "CRYP-2301-A06", "CRYP-447-A20", "CRYP-626-A05", "CRYP-671-A01", "CRYP-671-A02", "CRYP-876-A06", "DATA-2662-A05", "DATA-598-A05", "DATA-598-A06", "NET-1619-A02", "NET-1633-A02", "NET-806-A02", "NET-901-A04", "NET-920-A02", "NET-965", "SEC-2445-A01", "SEC-2841-A03", "SEC-3406", "SEC-3842-A02", "SEC-4028-A03", "SEC-4076-A02", "SEC-4509", "SEC-7963-A03", "SEC-7963-A04", "SEC-8334-A06", "SEC-8825-A05" ], "member_count": 135, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.82, "source_meta_cluster": "M33", "cluster_size": 66, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "token_validation_lifecycle", "name": "Authentifizierungs-Token Validierung und Gueltigkeit", "description": "Authentifizierungstoken muessen validiert werden, eine begrenzte Gueltigkeitsdauer haben und abgelaufene/nicht konforme Token abgelehnt werden.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "token", "applicability": "universal", "evidence_facets": { "governance": false, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "OWASP", "anchor": "ASVS V3.5", "role": "best_practice" } ], "member_review_units": [ "M124", "M127", "M67", "M90", "M64" ], "member_controls": [ "AUTH-1663-A07", "AUTH-1672-A04", "AUTH-1678-A05", "AUTH-1679-A05", "AUTH-1682-A04", "AUTH-1691-A04", "AUTH-1700-A05", "AUTH-1713-A01", "AUTH-1790-A05", "AUTH-1814", "AUTH-1814-A03", "AUTH-1820-A01", "AUTH-1836-A01", "AUTH-1840", "AUTH-1840-A01", "AUTH-1840-A02", "AUTH-1912-A03", "AUTH-1940-A01", "AUTH-2466-A07", "AUTH-2850-A01", "AUTH-3450-A01", "AUTH-3450-A06", "AUTH-3968-A06", "AUTH-3999", "AUTH-742-A08", "AUTH-762-A06", "AUTH-783-A03", "AUTH-783-A04", "AUTH-783-A07", "AUTH-783-A08", "AUTH-783-A12", "AUTH-804", "AUTH-816", "AUTH-818-A19", "AUTH-849-A14", "AUTH-849-A15", "AUTH-849-A21", "AUTH-849-A22", "AUTH-849-A38", "AUTH-849-A39", "AUTH-849-A53", "AUTH-849-A54", "AUTH-849-A68", "AUTH-855-A04", "AUTH-855-A19", "AUTH-855-A34", "AUTH-855-A50", "AUTH-855-A64", "AUTH-961-A15", "BND-001-A02", "BND-001-A07", "CRYP-1288-A10", "CRYP-1321-A03", "CRYP-1433-A02", "CRYP-1467-A03", "CRYP-1467-A08", "CRYP-1521-A03", "CRYP-1525-A08", "CRYP-2148-A01", "CRYP-2150-A02", "NET-467-A03", "NET-467-A11", "NET-909-A03", "SEC-1215-A01", "SEC-2899-A07", "SEC-305-A02", "SEC-305-A03", "SEC-305-A09", "SEC-305-A10", "SEC-8241-A01", "SEC-8244-A10" ], "member_count": 71, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.8, "source_meta_cluster": "M124", "cluster_size": 19, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "mutual_authentication", "name": "Gegenseitige (mutual) Authentifizierung", "description": "Bei Kommunikationsverbindungen ist gegenseitige Authentifizierung von Client und Server/Service umzusetzen, inkl. MITM-Schutz.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "token", "applicability": "conditional:network_communication", "evidence_facets": { "governance": false, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "NIST", "anchor": "IA-03", "role": "best_practice" } ], "member_review_units": [ "M24", "M96", "M84", "M135", "M153" ], "member_controls": [ "AUT-003", "AUT-004", "AUT-006", "AUTH-047-A04", "AUTH-1049-A17", "AUTH-1049-A41", "AUTH-1083", "AUTH-1083-A02", "AUTH-1306-A02", "AUTH-1306-A03", "AUTH-1439-A09", "AUTH-1445", "AUTH-1445-A01", "AUTH-1448", "AUTH-1463", "AUTH-1582", "AUTH-1582-A02", "AUTH-1696-A02", "AUTH-1861-A08", "AUTH-1865", "AUTH-1865-A01", "AUTH-1865-A08", "AUTH-1940-A08", "AUTH-1959-A07", "AUTH-1959-A10", "AUTH-2337-A07", "AUTH-2553", "AUTH-2553-A02", "AUTH-2635-A01", "AUTH-2635-A02", "AUTH-2635-A03", "AUTH-3542-A09", "AUTH-3647-A01", "AUTH-3647-A02", "AUTH-3648-A10", "AUTH-3672-A01", "AUTH-3963-A03", "AUTH-4125-A02", "AUTH-4127-A04", "AUTH-505", "AUTH-505-A02", "AUTH-532-A03", "AUTH-550", "AUTH-550-A01", "AUTH-550-A06", "AUTH-586", "AUTH-625", "AUTH-625-A01", "AUTH-806", "AUTH-806-A01", "AUTH-850-A04", "AUTH-850-A24", "AUTH-850-A33", "AUTH-850-A41", "COM-004", "COMP-074-A02", "COMP-074-A09", "COMP-1055", "COMP-1960-A05", "COMP-2129-A03", "COMP-2129-A09", "CRYP-1024-A03", "CRYP-1028-A03", "CRYP-1124-A04", "CRYP-1227", "CRYP-1227-A02", "CRYP-1227-A08", "CRYP-1250-A10", "CRYP-1305-A06", "CRYP-1323-A02", "CRYP-1421-A07", "CRYP-1431-A08", "CRYP-1433-A01", "CRYP-1433-A05", "CRYP-1458-A06", "CRYP-1466", "CRYP-1466-A01", "CRYP-1466-A02", "CRYP-1469-A01", "CRYP-1519-A06", "CRYP-1530-A02", "CRYP-1541-A06", "CRYP-1722-A02", "CRYP-1722-A07", "CRYP-1791-A02", "CRYP-193-A03", "CRYP-1993-A03", "CRYP-2188-A08", "CRYP-721-A02", "CRYP-780-A02", "CRYP-886-A01", "GOV-1403-A12", "GOV-500-A02", "GOV-500-A07", "GOV-500-A12", "GOV-500-A17", "HLT-122-A04", "IDA-002", "INC-978", "INC-978-A07", "NET-1233-A07", "NET-1471-A05", "NET-656-A06", "NET-656-A14", "NET-656-A22", "NET-656-A30", "NET-656-A38", "NET-656-A46", "NET-857-A03", "NET-857-A11", "NET-879-A03", "NET-931-A02", "NET-938-A06", "SEC-1223", "SEC-2788-A02", "SEC-2788-A08", "SEC-2809-A01", "SEC-2818-A01", "SEC-3383-A02", "SEC-3383-A07", "SEC-4292", "SEC-4292-A01", "SEC-4292-A02", "SEC-4292-A09", "SEC-4292-A10", "SEC-4733-A02", "SEC-5811-A01", "SEC-5811-A02", "SEC-6382-A03", "SEC-6925-A09" ], "member_count": 130, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.83, "source_meta_cluster": "M24", "cluster_size": 101, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "revocation_check", "name": "Widerrufs-/Sperrlistenpruefung bei Authentifizierung", "description": "Vor erfolgreicher Authentifizierung sind Zertifikats-Widerruf bzw. Sperrlisten zu pruefen.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "credential", "applicability": "conditional:certificate_based", "evidence_facets": { "governance": false, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "NIST", "anchor": "IA-05(2)", "role": "best_practice" } ], "member_review_units": [ "M24", "M50", "M52" ], "member_controls": [ "AUT-003", "AUT-004", "AUT-006", "AUTH-047-A04", "AUTH-1049-A17", "AUTH-1049-A41", "AUTH-1083", "AUTH-1083-A02", "AUTH-1306-A02", "AUTH-1306-A03", "AUTH-1439-A09", "AUTH-1445", "AUTH-1445-A01", "AUTH-1448", "AUTH-1463", "AUTH-1582", "AUTH-1582-A02", "AUTH-1583-A05", "AUTH-1628", "AUTH-1628-A02", "AUTH-1696-A02", "AUTH-1861-A08", "AUTH-1940-A08", "AUTH-1959-A07", "AUTH-1959-A10", "AUTH-2337-A07", "AUTH-2635-A01", "AUTH-2635-A02", "AUTH-2635-A03", "AUTH-3542-A09", "AUTH-3647-A01", "AUTH-3647-A02", "AUTH-3648-A10", "AUTH-3672-A01", "AUTH-4125-A02", "AUTH-4127-A04", "AUTH-532-A03", "AUTH-806", "AUTH-806-A01", "AUTH-850-A04", "AUTH-850-A24", "AUTH-850-A33", "AUTH-850-A41", "COM-004", "COMP-074-A02", "COMP-074-A09", "COMP-1960-A05", "COMP-2129-A03", "COMP-2129-A09", "CRYP-1028-A03", "CRYP-1227", "CRYP-1227-A02", "CRYP-1227-A08", "CRYP-1250-A10", "CRYP-1305-A06", "CRYP-1323-A02", "CRYP-1431-A08", "CRYP-1433-A01", "CRYP-1433-A05", "CRYP-1466", "CRYP-1466-A01", "CRYP-1466-A02", "CRYP-1469-A01", "CRYP-1519-A06", "CRYP-1530-A02", "CRYP-1722-A02", "CRYP-1722-A07", "CRYP-1791-A02", "CRYP-721-A02", "CRYP-886-A01", "GOV-1403-A12", "GOV-500-A02", "GOV-500-A07", "GOV-500-A12", "GOV-500-A17", "HLT-122-A04", "IDA-002", "NET-1471-A05", "NET-656-A06", "NET-656-A14", "NET-656-A22", "NET-656-A30", "NET-656-A38", "NET-656-A46", "NET-857-A03", "NET-857-A11", "NET-931-A02", "NET-938-A06", "SEC-1223", "SEC-2788-A02", "SEC-2788-A08", "SEC-2809-A01", "SEC-2818-A01", "SEC-3383-A02", "SEC-3383-A07", "SEC-4292", "SEC-4292-A01", "SEC-4292-A02", "SEC-4292-A10", "SEC-4733-A02", "SEC-5811-A01", "SEC-5811-A02", "SEC-6382-A03", "SEC-6925-A09" ], "member_count": 104, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.78, "source_meta_cluster": "M24", "cluster_size": 101, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "encrypted_auth_channel", "name": "Verschluesselte Authentifizierungskanaele", "description": "Authentifizierung muss ueber verschluesselte Kanaele erfolgen; unverschluesselte Authentifizierungskanaele sind zu deaktivieren.", "tier": "LEGAL_MINIMUM", "family": "authentication", "subdomain": "credential", "applicability": "universal", "evidence_facets": { "governance": false, "capability": true, "evidence": true }, "source_role": "LEGAL_BASIS", "legal_basis": [ { "source": "CRA", "regulation_code": "eu_2024_2847", "anchor": "Annex I (2)(e)", "citation": "protect the confidentiality of... transmitted... data... incl. encryption in transit" } ], "guidance_basis": [ { "source": "BSI", "anchor": "TR-02102-2", "role": "best_practice" } ], "member_review_units": [ "M37", "M117", "M167" ], "member_controls": [ "AUTH-1300-A02", "AUTH-1437-A03", "AUTH-1441-A07", "AUTH-1441-A08", "AUTH-1468-A02", "AUTH-148-A11", "AUTH-1747", "AUTH-1817", "AUTH-2419-A06", "AUTH-2425", "AUTH-2466-A08", "AUTH-2553-A12", "AUTH-2933-A04", "AUTH-2935", "AUTH-2935-A08", "AUTH-2937-A05", "AUTH-2996-A05", "AUTH-3255", "AUTH-3430-A02", "AUTH-3652", "AUTH-3652-A01", "AUTH-3652-A02", "AUTH-3652-A03", "AUTH-3652-A04", "AUTH-3652-A09", "AUTH-3908-A04", "AUTH-4027", "AUTH-577-A06", "AUTH-592-A04", "AUTH-710-A02", "AUTH-748", "AUTH-748-A02", "AUTH-784-A04", "AUTH-784-A05", "AUTH-784-A06", "AUTH-789", "AUTH-789-A01", "AUTH-925-A02", "AUTH-925-A09", "AUTH-925-A17", "COMP-1735-A09", "COMP-1791-A03", "CRYP-1255", "CRYP-1271", "CRYP-1431-A01", "CRYP-1525", "CRYP-1525-A01", "CRYP-1702-A03", "CRYP-1749", "CRYP-191-A02", "CRYP-224-A08", "CRYP-873", "NET-1291-A16", "NET-1471-A01", "SEC-2853-A04", "SEC-5595", "SEC-6107-A02" ], "member_count": 57, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.8, "source_meta_cluster": "M37", "cluster_size": 50, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "tls_certificate_auth", "name": "TLS-/Zertifikat-basierte Authentifizierung", "description": "Zertifikatsbasierte Authentifizierung von Geraeten/Diensten ueber TLS mit Vertrauensanker-Validierung und bidirektionaler Authentifizierung.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "token", "applicability": "conditional:certificate_based", "evidence_facets": { "governance": true, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "NIST", "anchor": "IA-05(2)", "role": "best_practice" } ], "member_review_units": [ "M45", "M7", "M20", "M47", "M135", "M141" ], "member_controls": [ "ACC-495", "ACC-495-A01", "ACC-495-A02", "AI-994-A04", "AI-994-A05", "AUTH-047-A07", "AUTH-1300-A01", "AUTH-1513-A04", "AUTH-1514", "AUTH-1517", "AUTH-1517-A01", "AUTH-1517-A02", "AUTH-1517-A05", "AUTH-1518", "AUTH-1518-A01", "AUTH-1518-A02", "AUTH-1518-A05", "AUTH-1522", "AUTH-1526-A03", "AUTH-1526-A04", "AUTH-1527-A03", "AUTH-1527-A08", "AUTH-1530-A01", "AUTH-1541", "AUTH-1541-A01", "AUTH-1580-A05", "AUTH-1580-A11", "AUTH-1583", "AUTH-1583-A02", "AUTH-1682-A07", "AUTH-1698-A03", "AUTH-1709-A11", "AUTH-1759", "AUTH-1778", "AUTH-1784", "AUTH-1808-A05", "AUTH-1808-A06", "AUTH-1820-A02", "AUTH-1821-A01", "AUTH-1836-A03", "AUTH-1842", "AUTH-1842-A01", "AUTH-1842-A02", "AUTH-1842-A06", "AUTH-1860-A03", "AUTH-2337-A03", "AUTH-2478-A04", "AUTH-2550-A11", "AUTH-2986", "AUTH-3550-A04", "AUTH-3670-A03", "AUTH-4098-A02", "AUTH-4098-A03", "AUTH-509-A04", "AUTH-694-A04", "AUTH-833", "AUTH-833-A06", "AUTH-833-A10", "AUTH-911-A12", "AUTH-952", "AUTH-952-A01", "COMP-1729-A03", "COMP-1729-A04", "COMP-2057-A04", "COMP-2057-A09", "COMP-2099-A04", "CRYP-1024-A03", "CRYP-1029-A03", "CRYP-1036-A03", "CRYP-1141-A03", "CRYP-1239-A02", "CRYP-1250-A03", "CRYP-1292", "CRYP-1292-A03", "CRYP-1292-A08", "CRYP-1458-A01", "CRYP-1521-A04", "CRYP-1533-A01", "CRYP-1541-A06", "CRYP-1688-A04", "CRYP-1724-A03", "CRYP-2019-A07", "CRYP-2188-A08", "CRYP-616-A02", "CRYP-738-A04", "CRYP-796-A04", "CRYP-802-A01", "CRYP-803-A02", "CRYP-849", "CRYP-860", "CRYP-879-A02", "CRYP-879-A08", "CRYP-880-A08", "CRYP-886", "CRYP-894-A03", "CRYP-947-A05", "INC-980-A05", "LOG-1704-A02", "LOG-1704-A08", "NET-1293-A09", "NET-928-A06", "NET-965-A07", "SEC-2721-A02", "SEC-2871-A05", "SEC-3156-A02", "SEC-3182", "SEC-3199", "SEC-3209", "SEC-3220", "SEC-3853-A03", "SEC-3922-A01", "SEC-4028-A08", "SEC-4248-A02", "SEC-4248-A03", "SEC-4513-A03", "SEC-5585-A06", "SEC-5873-A03", "SEC-8162-A01", "SEC-8162-A04", "SEC-8226-A04" ], "member_count": 120, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.82, "source_meta_cluster": "M45", "cluster_size": 53, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "service_to_service_auth", "name": "Service-zu-Service- und API-Authentifizierung", "description": "Alle API-Zugriffe und Service-zu-Service-Kommunikationen muessen authentisiert werden (mTLS, API-Keys, Tokens).", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "token", "applicability": "conditional:api_or_service", "evidence_facets": { "governance": true, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "OWASP", "anchor": "API Security Top 10", "role": "best_practice" }, { "source": "NIST", "anchor": "IA-03", "role": "best_practice" } ], "member_review_units": [ "M21", "M24", "M39", "M125", "M30" ], "member_controls": [ "ACC-513", "ACC-630-A05", "ACC-637-A01", "ACC-653-A01", "ACC-657-A02", "AI-814", "AI-814-A02", "AI-814-A06", "AI-814-A07", "AI-814-A11", "AI-814-A12", "AI-814-A16", "AI-814-A17", "AI-814-A21", "AI-814-A22", "AI-814-A26", "AI-814-A27", "API-001", "ARC-007-A06", "AUT-003", "AUT-004", "AUT-006", "AUTH-047-A04", "AUTH-1049-A17", "AUTH-1049-A35", "AUTH-1049-A41", "AUTH-1049-A50", "AUTH-1083", "AUTH-1083-A02", "AUTH-1092", "AUTH-1099-A04", "AUTH-1110", "AUTH-1303-A06", "AUTH-1306-A02", "AUTH-1306-A03", "AUTH-1439-A09", "AUTH-1445", "AUTH-1445-A01", "AUTH-1446", "AUTH-1446-A02", "AUTH-1448", "AUTH-1463", "AUTH-1463-A07", "AUTH-1468", "AUTH-1468-A03", "AUTH-1468-A04", "AUTH-1468-A07", "AUTH-1472-A01", "AUTH-1525-A03", "AUTH-1539-A03", "AUTH-1582", "AUTH-1582-A02", "AUTH-1583-A06", "AUTH-1635-A12", "AUTH-1637", "AUTH-1637-A01", "AUTH-1658-A05", "AUTH-1696-A02", "AUTH-1696-A03", "AUTH-1700-A04", "AUTH-1713", "AUTH-1716", "AUTH-1725", "AUTH-1753-A04", "AUTH-1809-A01", "AUTH-1809-A03", "AUTH-1809-A04", "AUTH-1826-A10", "AUTH-1861-A08", "AUTH-1877", "AUTH-1877-A01", "AUTH-1877-A02", "AUTH-1909", "AUTH-1909-A01", "AUTH-1909-A05", "AUTH-1938", "AUTH-1940-A08", "AUTH-1943", "AUTH-1943-A02", "AUTH-1946-A03", "AUTH-1959-A07", "AUTH-1959-A10", "AUTH-2289", "AUTH-2320", "AUTH-2337-A07", "AUTH-2417", "AUTH-2424-A01", "AUTH-2464", "AUTH-2553", "AUTH-2553-A02", "AUTH-2630", "AUTH-2630-A02", "AUTH-2635-A01", "AUTH-2635-A02", "AUTH-2635-A03", "AUTH-2817-A03", "AUTH-2817-A04", "AUTH-2817-A05", "AUTH-2935-A02", "AUTH-3038", "AUTH-3069", "AUTH-3077", "AUTH-3078", "AUTH-3108-A05", "AUTH-3112-A14", "AUTH-3151-A08", "AUTH-3161", "AUTH-3258", "AUTH-3258-A01", "AUTH-3258-A04", "AUTH-3258-A07", "AUTH-3258-A10", "AUTH-3450", "AUTH-3458-A01", "AUTH-3542-A09", "AUTH-3562", "AUTH-3594-A05", "AUTH-3645-A05", "AUTH-3645-A06", "AUTH-3647-A01", "AUTH-3647-A02", "AUTH-3648-A06", "AUTH-3648-A10", "AUTH-3672-A01", "AUTH-384", "AUTH-3906", "AUTH-3963-A03", "AUTH-4006-A14", "AUTH-4027-A03", "AUTH-4125-A02", "AUTH-4127-A04", "AUTH-4130", "AUTH-4130-A01", "AUTH-4133-A01", "AUTH-4135-A01", "AUTH-505", "AUTH-505-A02", "AUTH-532-A03", "AUTH-550", "AUTH-550-A01", "AUTH-550-A06", "AUTH-586", "AUTH-670-A06", "AUTH-756-A03", "AUTH-756-A04", "AUTH-762", "AUTH-762-A01", "AUTH-803-A03", "AUTH-806", "AUTH-806-A01", "AUTH-825-A01", "AUTH-827-A04", "AUTH-827-A05", "AUTH-827-A06", "AUTH-827-A09", "AUTH-827-A13", "AUTH-827-A14", "AUTH-837-A06", "AUTH-837-A13", "AUTH-838", "AUTH-838-A04", "AUTH-838-A06", "AUTH-838-A08", "AUTH-838-A24", "AUTH-838-A34", "AUTH-846", "AUTH-846-A01", "AUTH-846-A02", "AUTH-846-A07", "AUTH-846-A10", "AUTH-846-A11", "AUTH-846-A16", "AUTH-846-A17", "AUTH-846-A20", "AUTH-846-A21", "AUTH-846-A26", "AUTH-846-A27", "AUTH-846-A30", "AUTH-846-A31", "AUTH-846-A36", "AUTH-846-A39", "AUTH-846-A40", "AUTH-846-A45", "AUTH-846-A46", "AUTH-849", "AUTH-849-A10", "AUTH-849-A17", "AUTH-849-A28", "AUTH-849-A33", "AUTH-849-A34", "AUTH-849-A45", "AUTH-849-A48", "AUTH-849-A49", "AUTH-849-A60", "AUTH-850-A04", "AUTH-850-A24", "AUTH-850-A33", "AUTH-850-A41", "AUTH-909", "AUTH-914", "AUTH-915", "AUTH-915-A07", "AUTH-915-A13", "AUTH-915-A14", "AUTH-919-A01", "AUTH-919-A07", "AUTH-949-A18", "COM-004", "COMP-001-A41", "COMP-001-A83", "COMP-074-A02", "COMP-074-A09", "COMP-1055", "COMP-1079-A02", "COMP-1079-A10", "COMP-1812-A02", "COMP-1817", "COMP-1904-A01", "COMP-1960-A05", "COMP-2012-A02", "COMP-2129-A03", "COMP-2129-A09", "COMP-2182-A02", "COMP-3983-A09", "COMP-3983-A10", "COMP-3983-A14", "CRYP-1017-A01", "CRYP-1028-A03", "CRYP-1103-A11", "CRYP-1227", "CRYP-1227-A02", "CRYP-1227-A08", "CRYP-1250-A10", "CRYP-1255-A01", "CRYP-1305-A03", "CRYP-1305-A06", "CRYP-1323-A02", "CRYP-1421-A07", "CRYP-1431-A08", "CRYP-1433-A01", "CRYP-1433-A05", "CRYP-1466", "CRYP-1466-A01", "CRYP-1466-A02", "CRYP-1469-A01", "CRYP-1519-A06", "CRYP-1530-A02", "CRYP-1722-A02", "CRYP-1722-A07", "CRYP-1791-A02", "CRYP-1884-A04", "CRYP-193-A03", "CRYP-1993-A03", "CRYP-2094-A03", "CRYP-721-A02", "CRYP-868-A02", "CRYP-886-A01", "DATA-014-A01", "DATA-2668-A01", "DATA-4666-A04", "FIN-852", "FIN-891-A08", "GOV-1403-A12", "GOV-1605-A01", "GOV-1648-A01", "GOV-1648-A02", "GOV-3072-A05", "GOV-3871", "GOV-3909-A01", "GOV-3909-A02", "GOV-500-A02", "GOV-500-A07", "GOV-500-A12", "GOV-500-A17", "HLT-122-A04", "IDA-002", "IDA-005", "LAB-246-A08", "LOG-1859", "LOG-712-A04", "NET-1233-A07", "NET-1293-A04", "NET-1466-A09", "NET-1471", "NET-1471-A05", "NET-1633-A01", "NET-1669-A02", "NET-1683-A06", "NET-351-A09", "NET-380", "NET-656-A06", "NET-656-A14", "NET-656-A22", "NET-656-A30", "NET-656-A38", "NET-656-A46", "NET-825-A03", "NET-857-A02", "NET-857-A03", "NET-857-A11", "NET-859", "NET-859-A01", "NET-859-A02", "NET-859-A03", "NET-859-A04", "NET-860-A01", "NET-867-A07", "NET-879-A03", "NET-903-A09", "NET-931-A02", "NET-938-A06", "NET-965-A03", "SEC-1013-A03", "SEC-1013-A05", "SEC-1013-A07", "SEC-1153-A03", "SEC-1153-A23", "SEC-1153-A29", "SEC-1153-A47", "SEC-1153-A79", "SEC-1223", "SEC-2698-A01", "SEC-2788-A02", "SEC-2788-A08", "SEC-2809-A01", "SEC-2818-A01", "SEC-2818-A02", "SEC-2899", "SEC-2899-A02", "SEC-2927-A04", "SEC-3159-A05", "SEC-3217-A03", "SEC-3383-A02", "SEC-3383-A07", "SEC-3431-A05", "SEC-3633-A11", "SEC-3709-A10", "SEC-4292", "SEC-4292-A01", "SEC-4292-A02", "SEC-4292-A10", "SEC-4513", "SEC-4513-A02", "SEC-4561-A01", "SEC-4561-A03", "SEC-4733-A02", "SEC-5615", "SEC-5792-A02", "SEC-5811-A01", "SEC-5811-A02", "SEC-6170-A02", "SEC-6296", "SEC-6382-A03", "SEC-6784-A05", "SEC-6846-A05", "SEC-6925-A09", "SEC-7343-A03", "SEC-7963-A02", "SEC-8016", "SEC-8041-A07", "SEC-9014-A16", "SEC-9175" ], "member_count": 362, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.82, "source_meta_cluster": "M21", "cluster_size": 39, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" }, "merged_from": [ "npe_device_authentication" ] }, { "id": "auth_key_management", "name": "Verwaltung von Authentifizierungsschluesseln", "description": "Symmetrische und asymmetrische Authentifizierungsschluessel sind sicher zu erzeugen, zu speichern (HSM/zertifizierte Module) und zu verwalten.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "credential", "applicability": "conditional:crypto_auth", "evidence_facets": { "governance": true, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "BSI", "anchor": "TR-02102", "role": "best_practice" } ], "member_review_units": [ "M74", "M84", "M66", "M143", "M60", "M164" ], "member_controls": [ "AUTH-1650", "AUTH-1653-A06", "AUTH-1667-A01", "AUTH-1675", "AUTH-1675-A02", "AUTH-1681", "AUTH-1681-A01", "AUTH-1688-A05", "AUTH-1692-A05", "AUTH-1709-A07", "AUTH-1751", "AUTH-1751-A01", "AUTH-1751-A02", "AUTH-1819-A01", "AUTH-1828", "AUTH-1828-A01", "AUTH-1845-A04", "AUTH-1860-A04", "AUTH-1861", "AUTH-1861-A01", "AUTH-1862", "AUTH-1862-A01", "AUTH-1865", "AUTH-1865-A01", "AUTH-1865-A08", "AUTH-1910", "AUTH-1948", "AUTH-1949", "AUTH-1949-A07", "AUTH-1949-A09", "AUTH-625", "AUTH-625-A01", "COMP-1960", "COMP-1960-A02", "COMP-1960-A03", "CRYP-1044-A01", "CRYP-1089-A01", "CRYP-1124-A04", "CRYP-1158-A06", "CRYP-1162-A04", "CRYP-1201-A01", "CRYP-1217-A02", "CRYP-1433-A03", "CRYP-1439", "CRYP-1439-A01", "CRYP-1439-A08", "CRYP-1458-A06", "CRYP-1458-A09", "CRYP-1473", "CRYP-1535", "CRYP-1535-A04", "CRYP-1535-A05", "CRYP-1535-A11", "CRYP-1872-A02", "CRYP-780-A02", "CRYP-952-A01", "CRYP-973", "SEC-3683-A04", "SEC-3735-A02" ], "member_count": 59, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.82, "source_meta_cluster": "M74", "cluster_size": 18, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "biometric_authentication", "name": "Biometrische Authentifizierung", "description": "Biometrische Authentifizierung ist mit definierten Fehlerquoten, Deaktivierbarkeit und sicherer Verarbeitung umzusetzen.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "biometrics", "applicability": "conditional:biometric", "evidence_facets": { "governance": true, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "NIST", "anchor": "SP 800-63B 5.2.3", "role": "best_practice" } ], "member_review_units": [ "M101", "M51", "M38", "M115", "M100", "M30" ], "member_controls": [ "AUTH-1049-A35", "AUTH-1049-A50", "AUTH-1303-A05", "AUTH-1624", "AUTH-1637", "AUTH-1637-A01", "AUTH-1725", "AUTH-1790-A04", "AUTH-1901-A05", "AUTH-2452-A07", "AUTH-2464", "AUTH-2689-A04", "AUTH-2873-A04", "AUTH-2883-A03", "AUTH-2883-A05", "AUTH-2894-A07", "AUTH-2898-A02", "AUTH-2945-A11", "AUTH-3161", "AUTH-3166-A07", "AUTH-3595-A02", "AUTH-3652-A11", "AUTH-3677-A04", "AUTH-3921", "AUTH-3947", "AUTH-4006-A14", "AUTH-4135-A01", "AUTH-577-A04", "AUTH-637-A31", "AUTH-661-A09", "AUTH-661-A22", "AUTH-827-A04", "AUTH-827-A13", "AUTH-895-A07", "AUTH-895-A17", "AUTH-895-A27", "CRYP-1064-A10", "CRYP-1684-A07", "CRYP-1927-A13", "DATA-1810-A02", "DATA-4666-A04", "SEC-019-A02", "SEC-019-A14", "SEC-019-A29", "SEC-3383", "SEC-3383-A01", "SEC-4028-A04", "SEC-6846-A05", "SEC-7793-A09", "SEC-8996-A06" ], "member_count": 50, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.82, "source_meta_cluster": "M101", "cluster_size": 7, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "federated_auth_assertions", "name": "Foederierte Authentifizierung und Assertions", "description": "Bei foederierter Authentifizierung (SAML/OIDC) sind Assertions einmalig zu verwenden, IdP-Namespaces zu trennen und FAL-Anforderungen einzuhalten.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "token", "applicability": "conditional:federation", "evidence_facets": { "governance": true, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "NIST", "anchor": "SP 800-63C", "role": "best_practice" } ], "member_review_units": [ "M23", "M49", "M124", "M125", "M127", "M129", "M28" ], "member_controls": [ "AUT-002", "AUTH-088-A06", "AUTH-1005-A01", "AUTH-1052-A13", "AUTH-1052-A22", "AUTH-1052-A36", "AUTH-1059", "AUTH-1312-A01", "AUTH-1468-A09", "AUTH-1574-A02", "AUTH-1658", "AUTH-1658-A01", "AUTH-1658-A06", "AUTH-1658-A07", "AUTH-1663-A06", "AUTH-1785-A07", "AUTH-1859-A01", "AUTH-2417-A02", "AUTH-2573-A02", "AUTH-2793-A04", "AUTH-3286-A07", "AUTH-3545-A01", "AUTH-3634", "AUTH-3642-A04", "AUTH-3981-A06", "AUTH-4000-A01", "AUTH-515", "AUTH-515-A02", "AUTH-515-A03", "AUTH-515-A04", "AUTH-515-A07", "AUTH-524-A02", "AUTH-524-A06", "AUTH-524-A09", "AUTH-586-A01", "AUTH-700-A01", "AUTH-742-A08", "AUTH-756-A03", "AUTH-756-A04", "AUTH-762", "AUTH-762-A01", "AUTH-762-A06", "AUTH-816", "AUTH-820", "AUTH-820-A01", "AUTH-825-A01", "AUTH-838", "AUTH-838-A04", "AUTH-838-A06", "AUTH-838-A08", "AUTH-838-A24", "AUTH-838-A34", "AUTH-849-A14", "AUTH-849-A15", "AUTH-849-A21", "AUTH-849-A22", "AUTH-849-A38", "AUTH-849-A39", "AUTH-849-A53", "AUTH-849-A54", "AUTH-849-A68", "AUTH-855-A04", "AUTH-855-A19", "AUTH-855-A34", "AUTH-855-A50", "AUTH-855-A64", "AUTH-898", "AUTH-898-A09", "AUTH-898-A17", "AUTH-906-A04", "AUTH-906-A09", "AUTH-906-A14", "AUTH-906-A18", "AUTH-906-A24", "AUTH-941-A03", "AUTH-941-A09", "AUTH-941-A16", "AUTH-961-A15", "BND-001-A02", "BND-001-A07", "CRYP-1172-A02", "CRYP-1257", "CRYP-1389-A07", "CRYP-436", "CRYP-873-A07", "IDF-004", "IDF-004-A01", "IDF-006", "INC-978-A11", "LOG-712-A04", "NET-1683-A02", "SEC-1153-A03", "SEC-1153-A23", "SEC-1153-A29", "SEC-1153-A47", "SEC-1153-A79", "SEC-2809-A03", "SEC-8104", "SEC-8104-A04", "SEC-8244-A10" ], "member_count": 100, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.8, "source_meta_cluster": "M49", "cluster_size": 3, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "separate_authn_authz", "name": "Trennung von Authentifizierung und Autorisierung", "description": "Authentifizierungsschritt ist von Autorisierung/Anwendung zu trennen; minimal notwendige Daten verwenden.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "credential", "applicability": "universal", "evidence_facets": { "governance": true, "capability": true, "evidence": false }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "NIST", "anchor": "AC-03", "role": "best_practice" } ], "member_review_units": [ "M37", "M129", "M130", "M40" ], "member_controls": [ "AUTH-1300-A02", "AUTH-1437-A02", "AUTH-1437-A03", "AUTH-1441-A07", "AUTH-1441-A08", "AUTH-1468-A02", "AUTH-148-A11", "AUTH-1678-A07", "AUTH-1747", "AUTH-1753-A05", "AUTH-1817", "AUTH-1835-A08", "AUTH-1839-A05", "AUTH-1843-A07", "AUTH-1843-A09", "AUTH-1913", "AUTH-1947-A07", "AUTH-1959-A04", "AUTH-1959-A06", "AUTH-1959-A08", "AUTH-2419-A06", "AUTH-2425", "AUTH-2466-A08", "AUTH-2553-A12", "AUTH-2906-A01", "AUTH-2906-A08", "AUTH-2933-A04", "AUTH-2935", "AUTH-2935-A08", "AUTH-2937-A05", "AUTH-2943-A08", "AUTH-2987-A06", "AUTH-2996-A05", "AUTH-3255", "AUTH-3430-A02", "AUTH-3652", "AUTH-3652-A01", "AUTH-3652-A02", "AUTH-3652-A03", "AUTH-3652-A04", "AUTH-3652-A09", "AUTH-3908-A04", "AUTH-4007-A06", "AUTH-4031-A07", "AUTH-4043", "AUTH-4043-A06", "AUTH-4135-A03", "AUTH-577-A06", "AUTH-592-A04", "AUTH-710-A02", "AUTH-745-A05", "AUTH-748", "AUTH-748-A02", "AUTH-784-A04", "AUTH-784-A05", "AUTH-784-A06", "AUTH-789", "AUTH-789-A01", "AUTH-906-A04", "AUTH-906-A09", "AUTH-906-A14", "AUTH-906-A18", "AUTH-906-A24", "AUTH-925-A02", "AUTH-925-A09", "AUTH-925-A17", "AUTH-933", "AUTH-941-A03", "AUTH-941-A09", "AUTH-941-A16", "AUTH-942", "COMP-1735-A09", "COMP-3983-A12", "CRYP-1255", "CRYP-1271", "CRYP-1702-A03", "CRYP-191-A02", "CRYP-224-A08", "CRYP-873", "DATA-2663-A04", "NET-1014-A04", "NET-1291-A16", "NET-1471-A01", "SEC-1085", "SEC-2853-A04", "SEC-5792-A04", "SEC-6107-A02", "SEC-8104" ], "member_count": 88, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.75, "source_meta_cluster": "M129", "cluster_size": 9, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "remote_access_authentication", "name": "Starke Authentifizierung fuer Remote-/Wartungszugriffe", "description": "Remote-, WLAN- und Wartungszugriffe muessen ueber Authentifizierungs-Gateways mit starker Authentifizierung abgesichert werden.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "credential", "applicability": "conditional:remote_access", "evidence_facets": { "governance": true, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "NIST", "anchor": "AC-17", "role": "best_practice" } ], "member_review_units": [ "M1", "M13", "M96", "M144", "M46" ], "member_controls": [ "ACC-001-A14", "ACC-001-A17", "ACC-001-A29", "ACC-0410-A03", "ACC-082-A08", "ACC-082-A09", "ACC-082-A17", "ACC-082-A18", "ACC-320-A16", "ACC-320-A18", "ACC-320-A24", "ACC-320-A34", "ACC-320-A40", "ACC-320-A48", "ACC-478-A08", "ACC-499-A07", "ACC-508-A06", "ACC-559-A04", "ACC-578-A07", "ACC-584-A05", "ACC-607", "AI-052-A28", "AI-052-A29", "AI-797-A09", "AI-797-A18", "AI-797-A36", "AI-797-A45", "AI-924-A13", "AI-924-A14", "AUTH-008-A25", "AUTH-047-A02", "AUTH-1049-A56", "AUTH-1050-A13", "AUTH-1061-A75", "AUTH-1084", "AUTH-1093-A03", "AUTH-1095-A02", "AUTH-1096", "AUTH-1096-A01", "AUTH-1102-A14", "AUTH-112-A04", "AUTH-112-A17", "AUTH-1135-A03", "AUTH-1135-A04", "AUTH-1168-A02", "AUTH-1168-A03", "AUTH-1288", "AUTH-1299-A05", "AUTH-1300-A05", "AUTH-1313-A04", "AUTH-1314-A03", "AUTH-1445-A02", "AUTH-1463-A04", "AUTH-1463-A09", "AUTH-1466-A09", "AUTH-1468-A01", "AUTH-1468-A06", "AUTH-1522-A04", "AUTH-1522-A05", "AUTH-1524-A04", "AUTH-1529-A04", "AUTH-1634-A04", "AUTH-1640-A01", "AUTH-1645", "AUTH-1645-A02", "AUTH-1669-A05", "AUTH-1669-A06", "AUTH-1679", "AUTH-1679-A02", "AUTH-1711-A06", "AUTH-1742-A01", "AUTH-1742-A07", "AUTH-1748-A04", "AUTH-1748-A06", "AUTH-1759-A05", "AUTH-1790", "AUTH-1806", "AUTH-1818-A11", "AUTH-1860-A05", "AUTH-1860-A08", "AUTH-1860-A09", "AUTH-1862-A09", "AUTH-1865-A12", "AUTH-187-A11", "AUTH-1910-A05", "AUTH-1912-A07", "AUTH-1940-A04", "AUTH-2121-A04", "AUTH-2315-A04", "AUTH-2338-A04", "AUTH-2338-A09", "AUTH-2399-A07", "AUTH-2405-A06", "AUTH-2411", "AUTH-2413", "AUTH-2413-A01", "AUTH-2421-A03", "AUTH-2444-A08", "AUTH-2553", "AUTH-2553-A02", "AUTH-2660-A02", "AUTH-2793", "AUTH-2793-A02", "AUTH-2805-A06", "AUTH-2805-A11", "AUTH-2850", "AUTH-2851-A10", "AUTH-2875-A01", "AUTH-2879", "AUTH-2879-A02", "AUTH-2943-A01", "AUTH-2974-A04", "AUTH-2979-A07", "AUTH-3004", "AUTH-3007-A03", "AUTH-3011-A06", "AUTH-3016", "AUTH-3045-A04", "AUTH-3068-A06", "AUTH-3082-A10", "AUTH-3266-A07", "AUTH-3399-A06", "AUTH-3460-A04", "AUTH-3461-A03", "AUTH-3461-A05", "AUTH-3486-A05", "AUTH-3486-A10", "AUTH-3541-A06", "AUTH-3542-A06", "AUTH-3545", "AUTH-3554-A02", "AUTH-3595", "AUTH-3595-A06", "AUTH-3595-A08", "AUTH-3596", "AUTH-3596-A04", "AUTH-3597-A06", "AUTH-3599-A04", "AUTH-3638", "AUTH-3643-A06", "AUTH-3647", "AUTH-3751-A08", "AUTH-3948-A04", "AUTH-3958-A02", "AUTH-3963-A03", "AUTH-3964-A07", "AUTH-3993", "AUTH-3993-A02", "AUTH-4027-A02", "AUTH-4028-A05", "AUTH-4030-A03", "AUTH-4031-A08", "AUTH-4032-A02", "AUTH-4036-A04", "AUTH-4085", "AUTH-4085-A01", "AUTH-4095-A17", "AUTH-494-A02", "AUTH-505", "AUTH-505-A02", "AUTH-505-A06", "AUTH-532-A02", "AUTH-550", "AUTH-550-A01", "AUTH-550-A06", "AUTH-559-A04", "AUTH-559-A13", "AUTH-584-A06", "AUTH-586", "AUTH-586-A03", "AUTH-586-A04", "AUTH-615-A06", "AUTH-623-A07", "AUTH-623-A08", "AUTH-710-A06", "AUTH-732-A01", "AUTH-743-A04", "AUTH-743-A10", "AUTH-751-A05", "AUTH-751-A06", "AUTH-751-A07", "AUTH-751-A08", "AUTH-762-A11", "AUTH-774-A01", "AUTH-782-A06", "AUTH-784-A08", "AUTH-784-A09", "AUTH-795-A02", "AUTH-804-A05", "AUTH-822-A06", "AUTH-822-A08", "AUTH-824-A15", "AUTH-836", "AUTH-836-A01", "AUTH-836-A02", "AUTH-836-A06", "AUTH-836-A08", "AUTH-836-A09", "AUTH-836-A12", "AUTH-836-A17", "AUTH-836-A18", "AUTH-837-A07", "AUTH-845-A06", "AUTH-845-A07", "AUTH-845-A18", "AUTH-845-A19", "AUTH-845-A29", "AUTH-845-A38", "AUTH-845-A39", "AUTH-845-A50", "AUTH-845-A54", "AUTH-845-A55", "AUTH-846-A09", "AUTH-846-A19", "AUTH-846-A29", "AUTH-846-A38", "AUTH-846-A48", "AUTH-849-A03", "AUTH-849-A12", "AUTH-849-A19", "AUTH-849-A26", "AUTH-849-A27", "AUTH-849-A31", "AUTH-849-A32", "AUTH-849-A36", "AUTH-849-A43", "AUTH-849-A44", "AUTH-849-A46", "AUTH-849-A47", "AUTH-849-A51", "AUTH-849-A58", "AUTH-849-A59", "AUTH-850-A19", "AUTH-850-A29", "AUTH-850-A38", "AUTH-850-A46", "AUTH-925-A05", "AUTH-925-A06", "AUTH-925-A12", "AUTH-986-A08", "AUTH-986-A09", "AUTH-995-A05", "AUTH-995-A85", "AUTH-996-A04", "AUTH-996-A17", "COMP-1055", "COMP-1264-A04", "COMP-1904-A06", "COMP-1904-A07", "COMP-1948", "COMP-1948-A02", "COMP-2129-A04", "CRYP-1013-A01", "CRYP-1141-A09", "CRYP-1210-A09", "CRYP-1299-A09", "CRYP-1372-A05", "CRYP-1421-A07", "CRYP-1433-A07", "CRYP-1725-A02", "CRYP-1750-A09", "CRYP-1755-A04", "CRYP-1864-A05", "CRYP-191", "CRYP-193-A03", "CRYP-1993-A03", "CRYP-2142-A06", "CRYP-2148-A06", "CRYP-2179-A09", "CRYP-2334", "CRYP-289", "CRYP-303", "CRYP-447-A20", "CRYP-637-A10", "CRYP-671-A01", "CRYP-671-A02", "CRYP-713-A07", "CRYP-738-A06", "CRYP-790", "CRYP-876-A07", "CRYP-877-A06", "CRYP-900-A04", "CRYP-914-A06", "DATA-2493-A12", "DATA-2510-A07", "DATA-3376-A06", "DATA-4225-A04", "DATA-4317-A05", "DATA-598-A05", "DATA-598-A06", "GOV-180-A06", "GOV-180-A12", "GOV-2076-A13", "GOV-3110-A02", "LOG-107-A02", "LOG-1861-A06", "NET-1233-A07", "NET-1293-A02", "NET-334-A04", "NET-334-A10", "NET-806-A02", "NET-857-A06", "NET-857-A12", "NET-860-A09", "NET-879-A03", "NET-901-A04", "NET-920-A02", "NET-965", "SEC-052-A06", "SEC-093-A05", "SEC-093-A06", "SEC-2643-A15", "SEC-2738-A06", "SEC-2809", "SEC-2809-A02", "SEC-2809-A05", "SEC-2809-A09", "SEC-2841-A03", "SEC-2853-A01", "SEC-3383-A03", "SEC-3406", "SEC-3740-A03", "SEC-3842-A02", "SEC-3965-A02", "SEC-4028-A03", "SEC-4076-A02", "SEC-4292-A12", "SEC-4295", "SEC-4295-A04", "SEC-4509", "SEC-4513-A07", "SEC-4560-A03", "SEC-5435-A03", "SEC-5505-A05", "SEC-5767-A01", "SEC-6784-A08", "SEC-6804-A01", "SEC-6804-A02", "SEC-6833-A07", "SEC-7963-A03", "SEC-7963-A04", "SEC-7984-A07", "SEC-8334-A06" ], "member_count": 343, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.8, "source_meta_cluster": "M13", "cluster_size": 65, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "supplier_access_auth", "name": "Starke Authentifizierung fuer Lieferanten-/Vendor-Zugriffe", "description": "Externe Lieferanten- und Vendor-Zugriffe erfordern starke (Multi-Faktor-)Authentifizierung.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "mfa", "applicability": "conditional:third_party_access", "evidence_facets": { "governance": true, "capability": true, "evidence": true }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "ISO", "anchor": "ISO 27001 A.5.19", "role": "best_practice" } ], "member_review_units": [ "M94", "M29" ], "member_controls": [ "AUTH-088-A07", "AUTH-1011-A11", "AUTH-1011-A13", "AUTH-2473-A01", "AUTH-2473-A02", "AUTH-2484-A01", "AUTH-2552-A03", "AUTH-2689-A02", "AUTH-2968", "AUTH-2996", "AUTH-3021-A07", "AUTH-3165-A02", "AUTH-3333-A06", "AUTH-3469-A03", "AUTH-3547", "AUTH-3659-A01", "AUTH-3705-A02", "AUTH-3825-A08", "AUTH-3887-A01", "AUTH-3908-A05", "AUTH-3915", "AUTH-3915-A01", "AUTH-3929-A01", "AUTH-3958-A03", "AUTH-3968-A09", "AUTH-3977-A02", "AUTH-4083-A05", "AUTH-538-A04", "AUTH-648-A02", "AUTH-745-A04", "AUTH-785-A02", "AUTH-803", "AUTH-824-A09", "AUTH-824-A16", "AUTH-845-A02", "AUTH-845-A14", "AUTH-845-A25", "AUTH-845-A28", "AUTH-845-A46", "AUTH-902", "AUTH-903-A21", "AUTH-903-A22", "COMP-3978-A02", "CRYP-1751", "CRYP-1751-A01", "GIA-002", "LOG-1506-A03", "LOG-967-A06", "NET-040-A03", "NET-040-A12", "NET-1166-A05", "NET-1787-A12", "SEC-171-A47", "SEC-2781-A01", "SEC-387-A10", "SEC-387-A24", "SEC-3870", "SEC-418-A15", "SEC-5767", "SEC-5915-A06", "SEC-7686-A05", "SEC-8847-A02" ], "member_count": 62, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.72, "source_meta_cluster": "M94", "cluster_size": 55, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } }, { "id": "personal_admin_accounts", "name": "Persoenliche Authentifizierung fuer Administratoren", "description": "Administratoren muessen persoenliche, eindeutige Authentifizierungsmittel verwenden; keine Gruppen-/geteilten Konten ohne Rollentrennung.", "tier": "BEST_PRACTICE", "family": "authentication", "subdomain": "credential", "applicability": "conditional:admin_access", "evidence_facets": { "governance": true, "capability": true, "evidence": false }, "source_role": "GUIDANCE", "legal_basis": [], "guidance_basis": [ { "source": "ISO", "anchor": "ISO 27001 A.8.2", "role": "best_practice" }, { "source": "NIST", "anchor": "IA-04", "role": "best_practice" } ], "member_review_units": [ "M35", "M53" ], "member_controls": [ "AUTH-1283-A03", "AUTH-1295-A02", "AUTH-1313-A02", "AUTH-1524-A03", "AUTH-1627", "AUTH-1631-A01", "AUTH-1634", "AUTH-1634-A01", "AUTH-1646", "AUTH-1661-A10", "AUTH-1669-A01", "AUTH-1693", "AUTH-1693-A01", "AUTH-1721-A01", "AUTH-1734-A02", "AUTH-1811-A08", "AUTH-1858", "AUTH-1915", "AUTH-1915-A01", "AUTH-2317-A02", "AUTH-2375-A05", "AUTH-2416", "AUTH-2416-A05", "AUTH-2416-A08", "AUTH-2423", "AUTH-2423-A04", "AUTH-2430-A01", "AUTH-2793-A01", "AUTH-2850-A03", "AUTH-2850-A04", "AUTH-2875-A02", "AUTH-2921", "AUTH-2945", "AUTH-2956", "AUTH-2975", "AUTH-2995", "AUTH-3016-A14", "AUTH-3017-A07", "AUTH-3018-A05", "AUTH-3255-A02", "AUTH-3258-A02", "AUTH-3305", "AUTH-3425-A03", "AUTH-3430-A01", "AUTH-3550-A02", "AUTH-3597-A01", "AUTH-3751-A04", "AUTH-3865-A07", "AUTH-3948-A02", "AUTH-3955-A07", "AUTH-3958-A01", "AUTH-3958-A06", "AUTH-3987", "AUTH-3987-A02", "AUTH-4050", "AUTH-4121-A02", "AUTH-670", "AUTH-718", "AUTH-818-A08", "AUTH-818-A14", "AUTH-850", "AUTH-919", "AUTH-987", "AUTH-987-A01", "AUTH-987-A23", "AUTH-987-A24", "COMP-1264", "COMP-1745-A03", "COMP-1886-A08", "COMP-262-A01", "COMP-2876-A05", "COMP-3983", "COMP-3983-A13", "CRYP-1134-A05", "CRYP-1159-A02", "CRYP-1712-A01", "CRYP-1732-A01", "CRYP-1942-A10", "CRYP-2101-A02", "CRYP-2173-A01", "CRYP-2363-A05", "CRYP-880-A04", "DATA-4027-A02", "NET-004-A05", "NET-004-A09", "NET-004-A19", "NET-104-A02", "NET-104-A10", "NET-1293-A07", "NET-1309-A01", "NET-1343-A05", "NET-149-A01", "NET-149-A11", "NET-1856-A05", "SEC-171-A16", "SEC-171-A34", "SEC-2035-A04", "SEC-2153-A03", "SEC-2809-A04", "SEC-3223", "SEC-3643-A08", "SEC-3728-A08", "SEC-4561-A04", "SEC-5610-A02", "SEC-5780", "SEC-8325" ], "member_count": 106, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.74, "source_meta_cluster": "M35", "cluster_size": 99, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" }, "merged_from": [ "distinct_credentials_per_role" ] }, { "id": "firmware_software_authentication", "name": "Authentifizierung von Software-/Firmware-Komponenten", "description": "Software- und Firmware-Komponenten sowie Updates sind kryptografisch zu authentisieren und zu signieren.", "tier": "LEGAL_MINIMUM", "family": "authentication", "subdomain": "credential", "applicability": "universal", "evidence_facets": { "governance": false, "capability": true, "evidence": true }, "source_role": "LEGAL_BASIS", "legal_basis": [ { "source": "CRA", "regulation_code": "eu_2024_2847", "anchor": "Annex I (2)(c)", "citation": "ensure that vulnerabilities can be addressed through security updates... ensuring integrity" } ], "guidance_basis": [ { "source": "NIST", "anchor": "SI-07", "role": "best_practice" } ], "member_review_units": [ "M79", "M44", "M118", "M168", "M167" ], "member_controls": [ "AUTH-1480", "AUTH-1480-A01", "AUTH-1677-A02", "AUTH-1677-A08", "AUTH-1746", "AUTH-1746-A01", "AUTH-1825", "AUTH-2371-A05", "AUTH-2416-A07", "AUTH-2438", "AUTH-2817-A01", "AUTH-3068", "AUTH-3068-A01", "AUTH-3068-A03", "AUTH-3068-A05", "AUTH-3073-A01", "AUTH-3554-A01", "AUTH-3554-A05", "AUTH-3712", "AUTH-4048", "AUTH-4053", "AUTH-4130-A03", "CRYP-1089-A02", "CRYP-1214-A04", "CRYP-1751-A10", "CRYP-1751-A11", "DATA-1240-A08", "DATA-2572", "DATA-3649-A14", "INC-946-A11", "NET-981-A10", "SEC-1085-A09", "SEC-3991", "SEC-5595", "SEC-6377", "SEC-6784-A01", "SEC-6784-A02" ], "member_count": 37, "relationships": [], "citation_anchor_ids": [], "citation_status": "pending_span_anchor", "review_status": "draft", "provenance": { "discovery_confidence": 0.78, "source_meta_cluster": "M79", "cluster_size": 4, "llm_model": "claude-opus-4-8", "synthesis_version": "v1" } } ], "relationships": [ { "type": "depends_on", "from": "mfa_privileged_access", "to": "mfa_required", "note": "MFA fuer Privilegierte konkretisiert allgemeine MFA-Pflicht" }, { "type": "depends_on", "from": "step_up_authentication", "to": "user_authentication_required", "note": "Step-up setzt etablierte Basisauthentifizierung voraus" }, { "type": "depends_on", "from": "password_policy", "to": "user_authentication_required", "note": "Passwortregeln gelten innerhalb der Authentifizierungspflicht" }, { "type": "supports", "from": "credential_confidentiality_protection", "to": "credential_storage_hashing", "note": "sichere Speicherung dient Vertraulichkeit" }, { "type": "supports", "from": "account_lockout_failed_attempts", "to": "user_authentication_required", "note": "Lockout schuetzt Authentifizierung gegen Brute-Force" }, { "type": "produces_evidence_for", "from": "auth_failure_logging", "to": "user_authentication_required", "note": "Protokolle belegen Authentifizierungsdurchsetzung" }, { "type": "produces_evidence_for", "from": "auth_testing", "to": "user_authentication_required", "note": "Testnachweise belegen Wirksamkeit" }, { "type": "produces_evidence_for", "from": "auth_inventory", "to": "auth_suitability_assessment", "note": "Inventar ist Grundlage der Eignungsbewertung" }, { "type": "supports", "from": "auth_anomaly_detection", "to": "user_authentication_required", "note": "Anomalieerkennung staerkt Authentifizierungssicherheit" }, { "type": "implements", "from": "mutual_authentication", "to": "encrypted_auth_channel", "note": "mTLS realisiert verschluesselten gegenseitig authentisierten Kanal" }, { "type": "implements", "from": "tls_certificate_auth", "to": "mutual_authentication", "note": "Zertifikatsauth implementiert gegenseitige Authentifizierung" }, { "type": "supports", "from": "replay_protection_nonce", "to": "mutual_authentication", "note": "Nonces verhindern Replay in Auth-Protokollen" }, { "type": "derived_from", "from": "pki_pace_chip_authentication", "to": "strong_crypto_authentication", "note": "PACE/Chip-Auth ist konkrete Umsetzung kryptographischer Authentifizierung" }, { "type": "supports", "from": "auth_key_management", "to": "strong_crypto_authentication", "note": "Schluesselverwaltung untermauert kryptographische Authentifizierung" }, { "type": "depends_on", "from": "risk_based_authentication", "to": "auth_risk_assessment", "note": "AAL-Wahl basiert auf Risikobewertung" }, { "type": "depends_on", "from": "reauth_after_inactivity", "to": "session_binding_management", "note": "Reauth ist Teil des Session-Managements" }, { "type": "out_of_scope", "obligation": "pki_pace_chip_authentication", "review_units": [ "M54", "M58", "M61", "M65", "M77", "M137", "M142", "M148", "M166", "M153", "M85", "M86", "M76", "M81", "M133", "M55", "M75", "M78", "M89", "M91", "M56", "M63", "M69", "M80", "M82", "M88", "M22", "M16", "M59", "M60", "M64", "M66", "M70", "M71", "M67", "M68", "M73", "M74", "M83", "M84", "M117", "M143" ], "note": "domänenfremd (eID/Chip bzw. PSD2-SCA) — nicht CRA-Authentisierung" }, { "type": "out_of_scope", "obligation": "strong_customer_authentication", "review_units": [ "M92", "M67", "M93", "M11", "M115" ], "note": "domänenfremd (eID/Chip bzw. PSD2-SCA) — nicht CRA-Authentisierung" } ], "curation": { "version": "v1", "method": "human_reasoned_rules", "rules": [ "crypto_micro→guidance", "test_evidence→evidence_facet", "mechanism_families_kept", "foreign_domain→out_of_scope" ], "from_obligations": 54, "to_obligations": 29 } }