2.7.4 is hard to understand

[tghosth]

2.7.4:

[GRAMMAR] Verify that the secondary communications channel being used is secure and independent of the primary channel.

[tghosth]

@elarlang feels like it is not not in scope.

I think we need to look at the context to see whether it needs clarifying or rewording

[tghosth]

So I think this is in scope because it is basically saying you have to send OTPs or push notifications via a secure channel. I would suggest that this is not something you are implementing as such but rather how you choose a solution.

I would suggest rewording to:

"[GRAMMAR] Verify that the out of band verification (for example a code or a push notification) is sent via a secure channel which is separate to the application's primary communication mechanism."

@elarlang what do you think?

[elarlang]

How I need to test this requirement? (Is it verifiable?). What it gives extra to what is covered in V9 requirements?

[tghosth]

Enquiry/document review based testing.

However, the real problem I have with this is, is email a secure channel? Is SMS a security channel?

[jmanico]

NIST 800-63b does not consider email or SMS worthy as the primary method for MFA when it comes to sensitive data (AAL-2) and similar.