NIST SP 800-53 (controls) 5.2.0
| Ref | Title | Text | |
|---|---|---|---|
| IA-01 | Policy and Procedures | a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy that: (a | |
| IA-02 | Identification and Authentication (Organizational Users) | Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users. | |
| IA-02(01) in IA-2 |
Multi-factor Authentication to Privileged Accounts | Implement multi-factor authentication for access to privileged accounts. | |
| IA-02(02) in IA-2 |
Multi-factor Authentication to Non-privileged Accounts | Implement multi-factor authentication for access to non-privileged accounts. | |
| IA-02(03) in IA-2 |
Local Access to Privileged Accounts withdrawn | ||
| IA-02(04) in IA-2 |
Local Access to Non-privileged Accounts withdrawn | ||
| IA-02(05) in IA-2 |
Individual Authentication with Group Authentication | When shared accounts or authenticators are employed, require users to be individually authenticated before granting access to the shared accounts or resources. | |
| IA-02(06) in IA-2 |
Access to Accounts —separate Device | Implement multi-factor authentication for [Selection (one or more): local; network; remote] access to [Selection (one or more): privileged accounts; non-privileged accounts] such that: (a) One of the factors is provided by a device separate | |
| IA-02(07) in IA-2 |
Network Access to Non-privileged Accounts — Separate Device withdrawn | ||
| IA-02(08) in IA-2 |
Access to Accounts — Replay Resistant | Implement replay-resistant authentication mechanisms for access to [Selection (one or more): privileged accounts; non-privileged accounts]. | |
| IA-02(09) in IA-2 |
Network Access to Non-privileged Accounts — Replay Resistant withdrawn | ||
| IA-02(10) in IA-2 |
Single Sign-on | Provide a single sign-on capability for [Assignment: system accounts and services]. | |
| IA-02(11) in IA-2 |
Remote Access — Separate Device withdrawn | ||
| IA-02(12) in IA-2 |
Acceptance of PIV Credentials | Accept and electronically verify Personal Identity Verification-compliant credentials. | |
| IA-02(13) in IA-2 |
Out-of-band Authentication | Implement the following out-of-band authentication mechanisms under [Assignment: conditions]: [Assignment: out-of-band authentication]. | |
| IA-03 | Device Identification and Authentication | Uniquely identify and authenticate [Assignment: devices and/or types of devices] before establishing a [Selection (one or more): local; remote; network] connection. | |
| IA-03(01) in IA-3 |
Cryptographic Bidirectional Authentication | Authenticate [Assignment: devices and/or types of devices] before establishing [Selection (one or more): local; remote; network] connection using bidirectional authentication that is cryptographically based. | |
| IA-03(02) in IA-3 |
Cryptographic Bidirectional Network Authentication withdrawn | ||
| IA-03(03) in IA-3 |
Dynamic Address Allocation | (a) Where addresses are allocated dynamically, standardize dynamic address allocation lease information and the lease duration assigned to devices in accordance with [Assignment: organization-defined lease information and lease duration] ; | |
| IA-03(04) in IA-3 |
Device Attestation | Handle device identification and authentication based on attestation by [Assignment: configuration management process]. | |
| IA-04 | Identifier Management | Manage system identifiers by: a. Receiving authorization from [Assignment: personnel or roles] to assign an individual, group, role, service, or device identifier; b. Selecting an identifier that identifies an individual, group, role, servi | |
| IA-04(01) in IA-4 |
Prohibit Account Identifiers as Public Identifiers | Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts. | |
| IA-04(02) in IA-4 |
Supervisor Authorization withdrawn | ||
| IA-04(03) in IA-4 |
Multiple Forms of Certification withdrawn | ||
| IA-04(04) in IA-4 |
Identify User Status | Manage individual identifiers by uniquely identifying each individual as [Assignment: characteristics]. | |
| IA-04(05) in IA-4 |
Dynamic Management | Manage individual identifiers dynamically in accordance with [Assignment: dynamic identifier policy]. | |
| IA-04(06) in IA-4 |
Cross-organization Management | Coordinate with the following external organizations for cross-organization management of identifiers: [Assignment: external organizations]. | |
| IA-04(07) in IA-4 |
In-person Registration withdrawn | ||
| IA-04(08) in IA-4 |
Pairwise Pseudonymous Identifiers | Generate pairwise pseudonymous identifiers. | |
| IA-04(09) in IA-4 |
Attribute Maintenance and Protection | Maintain the attributes for each uniquely identified individual, device, or service in [Assignment: protected central storage]. | |
| IA-05 | Authenticator Management | Manage system authenticators by: a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator; b. Establishing initial authenticator content for | |
| IA-05(01) in IA-5 |
Password-based Authentication | For password-based authentication: (a) Maintain a list of commonly-used, expected, or compromised passwords and update the list [Assignment: frequency] and when organizational passwords are suspected to have been compromised directly or ind | |
| IA-05(02) in IA-5 |
Public Key-based Authentication | (a) For public key-based authentication: (1) Enforce authorized access to the corresponding private key; and (2) Map the authenticated identity to the account of the individual or group; and (b) When public key infrastructure (PKI) is used: | |
| IA-05(03) in IA-5 |
In-person or Trusted External Party Registration withdrawn | ||
| IA-05(04) in IA-5 |
Automated Support for Password Strength Determination withdrawn | ||
| IA-05(05) in IA-5 |
Change Authenticators Prior to Delivery | Require developers and installers of system components to provide unique authenticators or change default authenticators prior to delivery and installation. | |
| IA-05(06) in IA-5 |
Protection of Authenticators | Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access. | |
| IA-05(07) in IA-5 |
No Embedded Unencrypted Static Authenticators | Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage. | |
| IA-05(08) in IA-5 |
Multiple System Accounts | Implement [Assignment: security controls] to manage the risk of compromise due to individuals having accounts on multiple systems. | |
| IA-05(09) in IA-5 |
Federated Credential Management | Use the following external organizations to federate credentials: [Assignment: external organizations]. | |
| IA-05(10) in IA-5 |
Dynamic Credential Binding | Bind identities and authenticators dynamically using the following rules: [Assignment: binding rules]. | |
| IA-05(11) in IA-5 |
Hardware Token-based Authentication withdrawn | ||
| IA-05(12) in IA-5 |
Biometric Authentication Performance | For biometric-based authentication, employ mechanisms that satisfy the following biometric quality requirements [Assignment: biometric quality requirements]. | |
| IA-05(13) in IA-5 |
Expiration of Cached Authenticators | Prohibit the use of cached authenticators after [Assignment: time period]. | |
| IA-05(14) in IA-5 |
Managing Content of PKI Trust Stores | For PKI-based authentication, employ an organization-wide methodology for managing the content of PKI trust stores installed across all platforms, including networks, operating systems, browsers, and applications. | |
| IA-05(15) in IA-5 |
GSA-approved Products and Services | Use only General Services Administration-approved products and services for identity, credential, and access management. | |
| IA-05(16) in IA-5 |
In-person or Trusted External Party Authenticator Issuance | Require that the issuance of [Assignment: types of and/or specific authenticators] be conducted [Selection: in person; by a trusted external party] before [Assignment: registration authority] with authorization by [Assignment: personnel or | |
| IA-05(17) in IA-5 |
Presentation Attack Detection for Biometric Authenticators | Employ presentation attack detection mechanisms for biometric-based authentication. | |
| IA-05(18) in IA-5 |
Password Managers | (a) Employ [Assignment: password managers] to generate and manage passwords; and (b) Protect the passwords using [Assignment: controls]. | |
| IA-06 | Authentication Feedback | Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals. | |
| IA-07 | Cryptographic Module Authentication | Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication. | |
| IA-08 | Identification and Authentication (Non-organizational Users) | Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users. | |
| IA-08(01) in IA-8 |
Acceptance of PIV Credentials from Other Agencies | Accept and electronically verify Personal Identity Verification-compliant credentials from other federal agencies. | |
| IA-08(02) in IA-8 |
Acceptance of External Authenticators | (a) Accept only external authenticators that are NIST-compliant; and (b) Document and maintain a list of accepted external authenticators. | |
| IA-08(03) in IA-8 |
Use of FICAM-approved Products withdrawn | ||
| IA-08(04) in IA-8 |
Use of Defined Profiles | Conform to the following profiles for identity management [Assignment: identity management profiles]. | |
| IA-08(05) in IA-8 |
Acceptance of PIV-I Credentials | Accept and verify federated or PKI credentials that meet [Assignment: policy]. | |
| IA-08(06) in IA-8 |
Disassociability | Implement the following measures to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties: [Assignment: measures]. | |
| IA-09 | Service Identification and Authentication | Uniquely identify and authenticate [Assignment: system services and applications] before establishing communications with devices, users, or other services or applications. | |
| IA-09(01) in IA-9 |
Information Exchange withdrawn | ||
| IA-09(02) in IA-9 |
Transmission of Decisions withdrawn | ||
| IA-10 | Adaptive Authentication | Require individuals accessing the system to employ [Assignment: supplemental authentication techniques or mechanisms] under specific [Assignment: circumstances or situations]. | |
| IA-11 | Re-authentication | Require users to re-authenticate when [Assignment: circumstances or situations]. | |
| IA-12 | Identity Proofing | a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines; b. Resolve user identities to a unique individual; a | |
| IA-12(01) in IA-12 |
Supervisor Authorization | Require that the registration process to receive an account for logical access includes supervisor or sponsor authorization. | |
| IA-12(02) in IA-12 |
Identity Evidence | Require evidence of individual identification be presented to the registration authority. | |
| IA-12(03) in IA-12 |
Identity Evidence Validation and Verification | Require that the presented identity evidence be validated and verified through [Assignment: methods of validation and verification]. | |
| IA-12(04) in IA-12 |
In-person Validation and Verification | Require that the validation and verification of identity evidence be conducted in person before a designated registration authority. | |
| IA-12(05) in IA-12 |
Address Confirmation | Require that a [Selection: registration code; notice of proofing] be delivered through an out-of-band channel to verify the users address (physical or digital) of record. | |
| IA-12(06) in IA-12 |
Accept Externally-proofed Identities | Accept externally-proofed identities at [Assignment: identity assurance level]. | |
| IA-13 | Identity Providers and Authorization Servers | Employ identity providers and authorization servers to manage user, device, and non-person entity (NPE) identities, attributes, and access rights supporting authentication and authorization decisions in accordance with [Assignment: policy] | |
| IA-13(01) in IA-13 |
Protection of Cryptographic Keys | Cryptographic keys that protect access tokens are generated, managed, and protected from disclosure and misuse. | |
| IA-13(02) in IA-13 |
Verification of Identity Assertions and Access Tokens | The source and integrity of identity assertions and access tokens are verified before granting access to system and information resources. | |
| IA-13(03) in IA-13 |
Token Management | In accordance with [Assignment: policy], assertions and access tokens are: (a) generated; (b) issued; (c) refreshed; (d) revoked; (e) time-restricted; and (f) audience-restricted. |
74 of 1196.