I had a PM with some questions about mandates.

NIST, PCI DSS, HIPAA and other Standard Orgs set the guidelines and compliancy standards, which are used with system/baseline accreditations. The Standard Orgs don’t set policy/mandate but offer guidelines/standards that should be used! It’s on the GOV and Commercial sectors to set their own policies and enforce/mandate. Also think of NIST as the Top Tier Standard Org, which you will notice the other standard orgs ref: in their standard guidelines.

Computer Security Division (CSD) of NIST:
https://www.nist.gov/itl/csd

https://www.whitehouse.gov/presidential-actio...structure/

DEC 2014 the Federal Information Security Modernization Act FISMA was passed into law by the 113th Congress.
https://www.congress.gov/113/plaws/publ283/PL...ubl283.pdf

https://www.whitehouse.gov/sites/whitehouse.g...nal%29.pdf

https://www.dhs.gov/fisma:
GOV uses FISMA/OMB/FIPS policy to mandate, updated FY18 identifying OOBA and MFA! FY18 started 1 OCT 2017!

31 OCT 2017 FISMA Metrics:
https://www.dhs.gov/sites/default/files/publi...%20508.pdf

Identifies OOBA and MFA w/SP 800-63B is the GEM:
http://nvlpubs.nist.gov/nistpubs/SpecialPubli...0-53r4.pdf

Also Identifies NIST SP 800-63 which was rescinded with 63-2 in JUN 2017!

https://nvlpubs.nist.gov/nistpubs/SpecialPubl...0-63-2.pdf

SP 800-63-3, SP 800-63A, SP 800-63B , SP 800-63C
https://nvlpubs.nist.gov/nistpubs/SpecialPubl...00-63B.pdf
OOB/MFA w/PUSH !

PCI DSS:
https://www.pcisecuritystandards.org/about_us/
Multi-Factor Authentication Version: 1.0 Date: February 2017 Author: PCI Security Standards Council
OOBA and MFA
https://www.pcisecuritystandards.org/pdfs/Mul...nce-v1.pdf
NIST Special Publication 800-63B Digital Authentication Guideline

https://investorshangout.com/post/view?id=4938769

$SFOR/BST STRONG!!!!