Measuring NIST Authentication Standards Compliance by Higher Education Institutions
summary
Study audits public policies at 135 North American colleges drawn from US News lists, manually coding documents with two independent coders and reconciliation to check four NIST SP 800-63 controls: NIST SP 800-63, multi-factor authentication, password expiration, knowledge-based authentication. Results show near‑universal adoption of MFA at national and public universities but gaps at HBCU and regional colleges; widespread, outdated use of forced password rotation (most commonly yearly, sometimes 30–60 days), rule‑based composition, and KBA despite 2017 guidance against them.
AI-written summary · about
chapters (10)
- 0:00NIST compliance study intro
- 1:33Research question and focus
- 3:40Why NIST standards ideal
- 5:24Higher education selection
- 7:11Policy coding process
- 8:35MFA compliance results
- 9:39Password expiration compliance
- 10:44Password composition rules
- 11:49Knowledge-based auth compliance
- 12:52Study implications and conclusions
