2.7.1 Clear text out of band authenticators are not offered by default¶
Verify that clear text out of band (NIST “restricted”) authenticators, such as SMS or PSTN, are not offered by default, and stronger alternatives such as push notifications are offered first.
| Level 1 | X |
| Level 2 | X |
| Level 3 | X |
| CWE | NIST |
|---|---|
| 287 | 5.1.3.2 |