ASVS V6.1.3 requires that if your application has more than one way to authenticate, all of them are documented together with the security controls and the authentication strength that must be enforced consistently across them. It is a Level 2 requirement.
Why it matters
Attackers pick the weakest door. If the web login needs a second factor but the mobile API, the legacy basic auth endpoint or the password reset flow does not, the second factor protects nothing.
Auditors and attackers both start from the same question: how many ways are there in? Your answer should come from the document, not from memory.
How to implement it
Build an inventory. Search the router, the identity provider settings and the API gateway for anything that issues a session or token.
Pathway Factors Rate limit Notes
Web password+TOTP 2 yes primary
SSO (OIDC) IdP policy IdP enforce MFA at IdP
Mobile API token device key+PIN yes refresh rotation
Password reset email link 3/hour does not bypass MFA
Admin break glass hardware key alerts two person approval
Review it whenever you add a login method. V6.3.4 asks you to prove no undocumented pathway exists.
For each pathway also record who owns it and which test proves it. When the identity team changes a policy, they then know exactly which entries to check. Keep the document in the repository next to the code so a pull request that adds a login route also changes the table.
How to test it
Grep the codebase for endpoints that set a session cookie or return a token, and compare the result to the table. Any extra entry is either missing documentation or a vulnerability.
Pick one entry at random and walk through it end to end in staging. Confirm that the stated factors, limits and logging match what the table says. A document that fails this spot check will fail a real audit.
Common mistakes
-
Forgetting service accounts, API keys and recovery flows.
-
Documenting only the happy path.
-
Treating SSO as automatically strong without checking the IdP policy.
-
Writing the document once for an audit and never touching it again.
Quick check
Does a password reset count as a pathway?
Yes. It grants access to an account, so it needs the same strength considerations.
