Requirement
"Secure authentication technologies and procedures shall be implemented based on information access restrictions and the topic-specific policy on access control."[1]
Explanation
Authentication technology used by the organization should be modern and replay resistant. Where possible multi-factor authentication should be used.
