+IA-08(02) [M] Acceptance of External Authenticators

IA-08(02) [M] Acceptance of External Authenticators

Control

  1. Accept only external authenticators that are NIST-compliant; and
  2. Document and maintain a list of accepted external authenticators.

Discussion

Acceptance of only NIST-compliant external authenticators applies to organizational systems that are accessible to the public (e.g., public-facing websites). External authenticators are issued by nonfederal government entities and are compliant with [SP 800-63B](#e59c5a7c-8b1f-49ca-8de0-6ee0882180ce) . Approved external authenticators meet or exceed the minimum Federal Government-wide technical, security, privacy, and organizational maturity requirements. Meeting or exceeding Federal requirements allows Federal Government relying parties to trust external authenticators in connection with an authentication transaction at a specified authenticator assurance level.

Assessment Objective

  1. only external authenticators that are NIST-compliant are accepted;
    1. a list of accepted external authenticators is documented;
    2. a list of accepted external authenticators is maintained.

Assessment Method

Examine

Identification and authentication policy system security plan procedures addressing user identification and authentication system design documentation system configuration settings and associated documentation system audit records list of third-party credentialing products, components, or services procured and implemented by organization third-party credential verification records evidence of third-party credentials third-party credential authorizations other relevant documents or records

Interview

Organizational personnel with system operations responsibilities organizational personnel with information security responsibilities system/network administrators system developers organizational personnel with account management responsibilities

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by IA-08(02) [M] Acceptance of External Authenticators – Assessment Procedure
is blocked by Acceptance of Third-Party Credentials