Identification and Authentication

Identification and Authentication

Authorized By: Chief Information Security Officer (CISO)

Purpose/Overview

The purpose of this policy is to establish the technical requirements for user identification and authentication to prevent unauthorized access to Safire information systems. This policy mandates strict controls regarding password complexity, rotation, account lockout, session locking, and the use of Multi-Factor Authentication (MFA) to protect Safire’s information systems and data, including Controlled Unclassified Information (CUI).

Scope

This policy applies to all employees, contractors, consultants, systems, and third-party users accessing Safire information systems. It applies to all user accounts, privileged accounts (administrators), and service accounts.

Policy

Multi-Factor Authentication (MFA)

MFA is mandatory for:

• All remote network access (VPN, Remote Desktop).
• All users performing privileged (administrator) actions.
• All access to cloud-based systems processing CUI.

Password Complexity Requirements

All user-level passwords must meet the following strict complexity requirements:

• Minimum Length: Passwords must be a minimum of 12 characters .
• Complexity: Passwords must contain characters from at least three (3) of the following four categories:
• English uppercase characters (A-Z)
• English lowercase characters (a-z)
• Base 10 digits (0-9)
• Non-alphabetic special characters (e.g., !, $, #, %)
• Passphrases: Users are encouraged to use “passphrases” (a sentence or phrase) to meet length requirements easily (e.g., “BlueSky$InTheMorning24”).
• Prohibited Passwords: Passwords must not contain:
• The user’s account name or full name.
• Common dictionary words or sequences (e.g., “123456”, “Password”, “QWERTY”).
• Company-specific terms (e.g., “Safire”, “Sales”, “Admin”).

Password Management and History

• History: The system must retain a history of the last 24 passwords . Users are prohibited from reusing a password stored in the history.

• Maximum Age: Passwords must be changed every 90 days .

• Service Accounts: Passwords for service accounts (non-human) must be at least 25 characters long and rotated annually.

Access Control (Lockout and Session Lock)

To prevent brute-force attacks and unauthorized physical access:

• Account Lockout: Information systems must automatically lock a user account after five (5) consecutive invalid login attempts. The account must remain locked for a minimum of 30 minutes or until released by an administrator.
• Session Lock (Screensaver): Workstations and mobile devices must automatically activate a password-protected screensaver or session lock after 15 minutes of inactivity. Users must re-authenticate to unlock the device.

Password Protection and User Behavior

• Storage & Transmission: Passwords must not be stored or transmitted in plain text. They must be encrypted/hashed.
• No Sharing: Passwords must strictly not be shared with anyone, including managers, administrative assistants, or IT staff.
• No Writing: Users must not write passwords down on physical media (sticky notes) or store them in unencrypted digital files (Word/Excel).
• Browser Storage: Users must not use the “Remember Password” feature in web browsers for corporate credentials.
• Password Managers: Users are required to use the company-approved Enterprise Password Manager to store and generate complex passwords.

Application Development & SNMP

• App Dev: Developers must ensure applications support individual user authentication (not group accounts). Passwords must never be hard-coded into source code or scripts.
• SNMP: Default community strings (e.g., “public”, “private”) must be changed to complex strings different from standard login passwords

Compliance

Compliance Measurement

The policy owner will verify compliance through methods such as business tool reports and internal and external audits. Oversight is provided by CISO, IT, and Compliance functions. Enforcement of this policy is coordinated through Human Resources and Executive Management.

Exceptions

Any exceptions must be approved by the Policy Owner in advance.

Non-Compliance

Failure to adhere to this policy compromises the security of Safire. Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of

employment.

Related Standards, Policies, Plans, and Procedures

• Acceptable Use Policy

Referenced Terms

CUI

Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies.

Revision History

2026-08-20 — Darren Rush

Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page