Address Confirmation - Enrollment Code Validity Times, v3.0
The requirements for enrollment codes to only be available for certain periods of time depending on the transmission media of those enrollment codes.
Assessment Steps (5)
|
1
Document Times (DocumentTimes)
Does the CSP document all maximum validity times for enrollment codes?
Artifact
Documentation
Provide policies and practices indicating conformance.
|
|
2
Domestic Mail (DomesticMail)
Are enrollment codes sent by USPS to domestic addresses valid for a maximum of 10 days?
|
|
3
Foreign Mail (ForeignMail)
Are enrollment codes sent to foreign addresses valid for a maximum of 30 days?
|
|
4
SMS or Voice (SMSorVoice)
Are enrollment codes sent via SMS or by telephone valid for a maximum of 10 minutes?
|
|
5
Email (Email)
Are enrollment codes sent via E-mail valid for a maximum of 24 hours?
|
Conformance Criteria (5)
|
Document Times
document the maximum validities it allows for enrollment codes and only issue codes that meet the following limitations:
Citation
SP800-63A
Section 4.4.1.6 (IAL2) P5
|
|
Domestic Mail
10 days, when sent to a postal address of record within the contiguous United States;
Citation
SP800-63A
Section 4.4.1.6 (IAL2) P5
|
|
Foreign Mail
30 days, when sent to a postal address of record outside the contiguous United States;
Citation
SP800-63A
Section 4.4.1.6 (IAL2) P5
|
|
SMS or Voice
10 minutes, when sent to a telephone number of record (SMS or voice);
Citation
SP800-63A
Section 4.4.1.6 (IAL2) P5
|
|
Email
24 hours, when sent to an email address of record.
Citation
SP800-63A
Section 4.4.1.6 (IAL2) P5
|