IA-05(13) Expiration of Cached Authenticators
NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version
All changes in this version
Title
Expiration of Cached Authenticators
Control
Prohibit the use of cached authenticators after [Assignment: time period].
Discussion
Cached authenticators are used to authenticate to the local machine when the network is not available. If cached authentication information is out of date, the validity of the authentication information may be questionable.
Parameters
ia-05.13_odp: time period
Assessment objective
IA-05(13) the use of cached authenticators is prohibited after [Assignment: time period].
STIG rules that implement this control 10
Apple iOS/iPadOS 26 V1R3
- AIOS-26-011500 CAT II Apple iOS/iPadOS 26 must implement the management setting: treat AirDrop as an unmanaged destination.
- AIOS-26-011600 CAT III Apple iOS/iPadOS 26 must implement the management setting: not have any Family Members in Family Sharing.
Apple iOS/iPadOS 27 V1R1
- AIOS-27-010700 CAT II Apple iOS/iPadOS 27 must implement the management setting: treat AirDrop as an unmanaged destination.
- AIOS-27-010800 CAT III Apple iOS/iPadOS 27 must implement the management setting: not have any Family Members in Family Sharing.
Application Security and Development V6R5
- APSC-DV-001800 CAT II The application must terminate existing user sessions upon account deletion.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-631015 CAT III Ubuntu 22.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-400340 CAT III Ubuntu 24.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.
Microsoft Edge V2R5
- EDGE-00-000043 CAT II The Password Manager must be disabled.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-701290 CAT II RHEL 10 must prohibit the use of cached authenticators after one day.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-631020 CAT II RHEL 9 must prohibit the use of cached authenticators after one day.