For customers not using SSO, does your solution support local authentication protocols for user and administrator authentication?

This question is asking whether your software solution supports local authentication methods for users and administrators when Single Sign-On (SSO) is not being used. Local authentication refers to authentication mechanisms that are managed directly within your application rather than delegated to an external identity provider. Examples include username/password combinations stored in your application's database, multi-factor authentication managed by your application, or other built-in authentication protocols. This question is being asked in a security assessment because organizations need to understand all available authentication options for your solution. While SSO is often preferred for enterprise environments (as it centralizes identity management), many organizations may not have SSO capabilities or may need alternative authentication methods for certain scenarios. Security assessors want to ensure that even when local authentication is used, it follows security best practices. To best answer this question, you should: 1. Clearly state whether your solution supports local authentication when SSO is not used 2. Describe the specific local authentication protocols supported (e.g., username/password, multi-factor authentication, etc.) 3. Mention any security features implemented for these local authentication methods (password complexity requirements, account lockout policies, etc.) 4. Explain how administrator authentication differs from regular user authentication, if applicable 5. Note any compliance standards your local authentication methods adhere to