ISO 27001 A.8.5: secure sign in, explained for startups

A.8.5 Secure authentication

Signing in takes more than a password on every important system. What proves it: multi-factor authentication (MFA) enforced on email, your identity provider, the cloud console and code hosting.

A certification auditor samples multi-factor authentication settings. A file that usually does the job: a screenshot of the policy requiring MFA in your identity provider and in your cloud console.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.8.5 walks you through it in this order.

1. Turn on MFA enforcement in your identity provider for every user.
2. Require MFA for the cloud console and code hosting.
3. Screenshot the enforcement settings.

The free ISO 27001 readiness assessment asks one question that evidences it:

• Is multi-factor authentication (MFA) enforced for everyone on email, your cloud console and your code host?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the Access Control Policy covers A.8.5. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

Connected systems that pull evidence for it:

• Amazon Web Services, IAM users: who has access, with each user's multi-factor authentication status and last login.
• Amazon Web Services, IAM account summary: account-wide counts, including users and whether root multi-factor authentication is on.
• GitHub, Organization two-factor enforcement: whether two-factor authentication is required for every organization member.
• Google Workspace, 2-Step Verification status: per-user 2-Step Verification enrollment, summarized for the domain.
• Okta, Multi-factor enrollment: how many active users have at least one active multi-factor authentication factor.
• Okta, Sign-on policies: sign-on and authentication policies, and whether their rules require multi-factor authentication.
• Microsoft Entra ID, Multi-factor registration: how many users have registered a multi-factor authentication method.
• Microsoft Entra ID, Conditional access policies: enabled conditional access policies that require multi-factor authentication.

The same evidence counts toward SOC 2. The Trust Services criterion that cover this ground: CC6.1, logical access.

Technological controls

A.8.5 is one of the 34 technological controls in Annex A. The controls built into your systems: access, devices, malware, vulnerabilities, backups, logging, networks, encryption and secure development. Exports and settings screenshots prove most of them.

Nearby controls in the same theme:

• A.8.2, privileged access
• A.8.3, restricting access to data
• A.8.4, source code access
• A.8.6, capacity
• A.8.7, malware protection
• A.8.8, vulnerability management

Before it: A.8.4, source code access. After it: A.8.6, capacity. Every control, by theme, is on the Annex A controls page.