FIDO Regulatory Compliance & Legal Framework 3

Question 1

A FIDO authenticator vendor wants to claim FIPS 140-2 compliance. Which component of the authenticator must be validated?

Accepted Answer

The cryptographic module performing key operations

Answer

FIPS 140-2 validation applies specifically to the cryptographic module that performs key generation, signing, and other cryptographic operations.

Question 2

Under the Americans with Disabilities Act (ADA), what obligation do relying parties have when deploying FIDO authentication?

Accepted Answer

Offer accessible alternatives for users who cannot use physical authenticators

Answer

ADA compliance requires relying parties to provide reasonable accommodations, including accessible authentication alternatives for users who cannot operate standard FIDO devices.

Question 3

Which regulatory framework specifically addresses strong customer authentication (SCA) for online payments in Europe and is compatible with FIDO2?

Accepted Answer

PSD2

Answer

PSD2's Strong Customer Authentication (SCA) requirements mandate two-factor authentication for online payments, which FIDO2 authenticators can satisfy.

Question 4

A FIDO relying party in the financial sector is subject to FFIEC guidance. What does FFIEC guidance say about authentication risk assessments?

Accepted Answer

Institutions must perform periodic risk assessments to evaluate authentication adequacy

Answer

FFIEC guidance requires financial institutions to conduct periodic risk assessments of their authentication controls to ensure they remain adequate against evolving threats.

Question 5

The Cybersecurity Maturity Model Certification (CMMC) for US defense contractors requires MFA for which scenario?

Accepted Answer

Remote access and access to CUI (Controlled Unclassified Information)

Answer

CMMC Level 2 and above requires MFA for remote access and for accessing systems containing Controlled Unclassified Information (CUI).

(FIDO) FIDO Certified Authenticator Practice Test

(FIDO) FIDO Certified Authenticator Practice Test

FIDO Regulatory Compliance & Legal Framework 3