SFS 3: Authentication and Authorization
Assess how identities are verified, accounts are managed, and access permissions are granted, reviewed, and withdrawn.
Scope and boundaries
This set covers user and service identities, authentication services, federation, directory services, password handling, multifactor authentication, sessions, and role-based access. It also considers account creation, permission review, and timely removal of access. Each question should specify the identities and resources in scope and the evidence needed to show that the access rule is applied. Special handling of administrator and master credentials belongs to SFS 1; authorization across service interfaces is coordinated with SFS C.
The sixteen questions
Each SF position is one question. Both positions run from 0 to F.
| SF | Question page | Authoring record |
|---|---|---|
| 0 | SF 0 | 0030 |
| 1 | SF 1 | 0031 |
| 2 | SF 2 | 0032 |
| 3 | SF 3 | 0033 |
| 4 | SF 4 | 0034 |
| 5 | SF 5 | 0035 |
| 6 | SF 6 | 0036 |
| 7 | SF 7 | 0037 |
| 8 | SF 8 | 0038 |
| 9 | SF 9 | 0039 |
| A | SF A | 003A |
| B | SF B | 003B |
| C | SF C | 003C |
| D | SF D | 003D |
| E | SF E | 003E |
| F | SF F | 003F |
From questions to a profile
Only reviewed, accepted 0/1 assessments can populate the sixteen-bit set profile. SF 0 is the most significant bit and SF F the least significant bit. The completed result uses four hexadecimal digits, including leading zeros. A catalog definition does not establish a completed assessment profile.
Read assessment and validation, then encoding. A set profile preserves individual answers; it is not a summed security score.