Page 396

The University of SydneyPage 4Recap of Week 6–Use of a RESTRICTED authenticator entails the risk of an authentication error be borne by the organization and the subscriber. –1. Offer the subscribers at least one alternative authenticator that is not restricted.–2. Provide meaningful notice to subscribers regarding the security risks of the RESTRICTED authenticator and availability of alternative(s) that are not RESTRICTED.–3. Address any additional risk to subscribers in its risk assessment.–4. Develop a migration plan for the possibility that the RESTRICTED authenticator is no longer acceptable at some point in the future.