Pages mapping authentik identity controls to specific regulatory access control and authentication requirements, using verified requirement text.
How a self-hosted authentik deployment supports HIPAA Security Rule technical safeguards for systems holding ePHI: unique user IDs, access policies, session timeouts for automatic logoff and MFA for person or entity authentication, and what evidence it leaves for audits.
Using authentik to meet PCI DSS v4.0.1 requirement 8 for access into the cardholder data environment: MFA for CDE and remote access, phishing-resistant passkeys, idle session re-authentication, lockout and password rules, and account lifecycle.
How authentik supports SOC 2 CC6.1 to CC6.3 logical access criteria: MFA and SSO for in-scope systems, joiner and leaver handling with provisioning and offboarding, access reviews and the event evidence auditors sample.
Mapping authentik to the NIST SP 800-53 IA family: organizational user identification and MFA, device and service identities, authenticator management and the evidence assessors examine.
How authentik supports NIS2 Article 21(2)(j) MFA and 21(2)(i) access control: MFA by group and application, separate admin credentials, identity lifecycle, failed login handling and evidence for essential and important entities.
Mapping authentik to ISO/IEC 27001:2022 A.8.5 secure authentication, A.5.17 authentication information and A.5.18 access rights: password and MFA policies, role design, access reviews and audit sampling.
How authentik supports CMMC Level 2 identification and authentication requirements: MFA for privileged and network access, replay-resistant authenticators, password rules, and POA&M treatment.
Using authentik to support GDPR Article 32 and Article 25 obligations: access control and MFA to personal data systems, self-hosting in the EU, event retention and deletion settings, and enforcement examples.
Mapping authentik to DORA Article 9 and the ICT risk RTS access requirements: strong authentication, least privilege, access reviews and revocation for financial entities.
Mapping authentik to CIS Controls 5 and 6: centralized account management, MFA for externally exposed applications, remote network access and administrative access, and access revocation.
How authentik supports SOX IT general controls over access to programs and data: provisioning and removal, periodic access reviews, privileged access and the evidence external auditors test.
Mapping authentik to the NIST CSF 2.0 PR.AA category: identity management, authentication, identity proofing, access permissions and least privilege, with related SP 800-53 controls.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.