Two-Factor Authentication for Regulatory Compliance

Two-factor authentication is no longer optional for many businesses. PhoneFactor is a rapid, cost-effective way to comply with FFIEC Guidelines, PCI Data Security Standards, HIPAA, NIST, and other industry regulations.

In addition, PhoneFactor has achieved SAS 70 Certification, demonstrating the company’s adherence to the rigorous requirements set forth by the Statement on Auditing Standards No. 70. The certification underscores the security and reliability of the company’s two-factor authentication platform. For organizations that are operating in regulatory compliant environments, selecting service providers who have proven compliance with SAS 70 standards is essential.

Agencies Implement Stronger Requirements for Two-Factor Authentication
Password phishing is up dramatically and new, more sophisticated phishing methods have emerged. It’s clear that passwords are highly susceptible to attack and agents can’t be trusted to employ best practices with regard to storing and changing their passwords, let alone protecting their PC from malware that could be used to snoop their passwords.

Two-factor authentication (using a password, something you know, plus a second method, such as something you have or something you are to prove a user’s identity) is the new standard.

Regulatory agencies agree that passwords are a weak link and are requiring companies to implement stronger authentication. Depending on the industry, a number of regulations may require an organization to apply strict standards for authenticating users, including:

• Payment Card Industry Data Security Standards (PCI DSS)
• Health Insurance Portability and Accountability Act (HIPAA)
• Authentication in an Internet Banking Environment Guidance (FFIEC)
• Identity Theft Red Flag Rules (FACTA)
• American’s with Disabilities Act (ADA) Section 508
• NIST 800-63 Electronic Authentication Guideline
• Criminal Justice Information System (CJIS) Security Policy
• Sarbanes-Oxley

PhoneFactor Offers Rapid, Cost Effective Compliance with Industry Regulations
With PhoneFactor, there are no devices, software, or certificates to deploy and maintain – it works with the user’s existing phone (landline or mobile). Users require very little training and almost no ongoing support – making PhoneFactor significantly less expensive to setup and maintain than other two-factor solutions.

PhoneFactor offers instant integration with all leading business systems and synchronizes with AD and LDAP Servers for centralized user management. Easy, automated self-service options are available through the phone and web, which helps to expedite deployment and minimize overhead.