Waking the zombie at my own peril and for the benefit of people looking to understand this control. I did a fair amount of research on the subject and was able to find a pretty definitive answer. Stay with me because it isn't short, but it's pretty definitive.
As best I understand it, if you are an implementor of a cryptographic control module that provides an authentication mechanism or if your system provides access to a cryptographic control module that provides authentication then you must meet the authentication requirements "...of applicable laws...standards..." etc. This reference is calling out the requirements in FIPS 140-2 which refer to a human operator interacting with a FIPS 140-2 compliant cryptographic control module.
4.3.3 Operator Authentication Authentication mechanisms may be required within a cryptographic module to authenticate an operator
accessing the module and to verify that the operator is authorized to
assume the requested role and perform services within that role.
Depending on the security level, a cryptographic module shall support
at least one of the following mechanisms to control access to the
Role-Based Authentication: If role-based authentication mechanisms are
supported by a cryptographic module, the module shall require that one
or more roles either be implicitly or explicitly selected by the
operator and shall authenticate the assumption of the selected role
(or set of roles). The cryptographic module is not required to
authenticate the individual identity of the operator. The selection of
roles and the authentication of the assumption of selected roles may
be combined. If a cryptographic module permits an operator to change
roles, then the module shall authenticate the assumption of any role
that was not previously authenticated.
Identity-Based Authentication: If identity-based authentication
mechanisms are supported by a cryptographic module, the module shall
require that the operator be individually identified, shall require
that one or more roles either be implicitly or explicitly selected by
the operator, and shall authenticate the identity of the operator and
the authorization of the operator to assume the selected role (or set
of roles). The authentication of the identity of the operator,
selection of roles, and the authorization of the assumption of the
selected roles may be combined. If a cryptographic module permits an
operator to change roles, then the module shall verify the
authorization of the identified operator to assume any role that was
not previously authorized.
...so that's what this rule is talking about.
This control is only applicable if you're providing authentication to the cryptographic module for purposes of managing the cryptographic module. Evidence that it is not applicable in other cases can be found in a STIG (although not easily)...
Details Check Text ( C-70635r1_chk ) Review the application
documentation and interview the application administrator.
Identify if the application provides access to cryptographic modules
and if access is required in order to manage cryptographic modules
contained within the application.
If the application does not provide authenticated access to a
cryptographic module, the requirement is not applicable.
Review and identify the cryptographic module. Refer to the NIST
website listing all FIPS-approved cryptographic modules.
It seems like an uncommon use case in the private sector but may be more common in government sectors like DoD.