+IA-08 Identification and Authentication (Non-organizational Users)
---+IA-08(01) Acceptance of PIV Credentials from Other Agencies
---+IA-08(02) Acceptance of External Authenticators
---+IA-08(04) Use of Defined Profiles
---+IA-08(05) Acceptance of PIV-I Credentials
---+IA-08(06) Disassociability
|
IA-08 Identification and Authentication (Non-organizational Users)
Control
Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
Discussion
Non-organizational users include system users other than organizational users explicitly covered by [IA-2](#ia-2) . Non-organizational users are uniquely identified and authenticated for accesses other than those explicitly identified and documented in [AC-14](#ac-14) . Identification and authentication of non-organizational users accessing federal systems may be required to protect federal, proprietary, or privacy-related information (with exceptions noted for national security systems). Organizations consider many factors—including security, privacy, scalability, and practicality—when balancing the need to ensure ease of use for access to federal information and systems with the need to protect and adequately mitigate risk.
Assessment Objective
non-organizational users or processes acting on behalf of non-organizational users are uniquely identified and authenticated.
Assessment Method
Examine
Identification and authentication policy
system security plan
privacy plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
list of system accounts
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
organizational personnel with account management responsibilities
1. Oversigt
| Titel |
Standard |
|
IA-08(01) Acceptance of PIV Credentials from Other Agencies
|
Control
Accept and electronically verify Personal Identity Verification-compliant credentials from other federal agencies.
Discussion
Acceptance of Personal Identity Verification (PIV) credentials from other federal agencies applies to both logical and physical access control systems. PIV credentials are those credentials issued by federal agencies that conform to FIPS Publication 201 and supporting guidelines. The adequacy and reliability of PIV card issuers are addressed and authorized using [SP 800-79-2](#10963761-58fc-4b20-b3d6-b44a54daba03).
Assessment Objective
- Personal Identity Verification-compliant credentials from other federal agencies are accepted;
- Personal Identity Verification-compliant credentials from other federal agencies are electronically verified.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
PIV verification records
evidence of PIV credentials
PIV credential authorizations
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with account management responsibilities
|
|
IA-08(02) Acceptance of External Authenticators
|
Control
- Accept only external authenticators that are NIST-compliant; and
- Document and maintain a list of accepted external authenticators.
Discussion
Acceptance of only NIST-compliant external authenticators applies to organizational systems that are accessible to the public (e.g., public-facing websites). External authenticators are issued by nonfederal government entities and are compliant with [SP 800-63B](#e59c5a7c-8b1f-49ca-8de0-6ee0882180ce) . Approved external authenticators meet or exceed the minimum Federal Government-wide technical, security, privacy, and organizational maturity requirements. Meeting or exceeding Federal requirements allows Federal Government relying parties to trust external authenticators in connection with an authentication transaction at a specified authenticator assurance level.
Assessment Objective
- only external authenticators that are NIST-compliant are accepted;
- a list of accepted external authenticators is documented;
- a list of accepted external authenticators is maintained.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
list of third-party credentialing products, components, or services procured and implemented by organization
third-party credential verification records
evidence of third-party credentials
third-party credential authorizations
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with account management responsibilities
|
|
IA-08(04) Use of Defined Profiles
|
Control
Conform to the following profiles for identity management [Assignement: identity management profiles].
Discussion
Organizations define profiles for identity management based on open identity management standards. To ensure that open identity management standards are viable, robust, reliable, sustainable, and interoperable as documented, the Federal Government assesses and scopes the standards and technology implementations against applicable laws, executive orders, directives, policies, regulations, standards, and guidelines.
Assessment Objective
there is conformance with [Assignement: identity management profiles] for identity management.
Assessment Method
Examine
Identification and authentication policy
system security plan
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with account management responsibilities
|
|
IA-08(05) Acceptance of PIV-I Credentials
|
Control
Accept and verify federated or PKI credentials that meet [Assignement: policy].
Discussion
Acceptance of PIV-I credentials can be implemented by PIV, PIV-I, and other commercial or external identity providers. The acceptance and verification of PIV-I-compliant credentials apply to both logical and physical access control systems. The acceptance and verification of PIV-I credentials address nonfederal issuers of identity cards that desire to interoperate with United States Government PIV systems and that can be trusted by Federal Government-relying parties. The X.509 certificate policy for the Federal Bridge Certification Authority (FBCA) addresses PIV-I requirements. The PIV-I card is commensurate with the PIV credentials as defined in cited references. PIV-I credentials are the credentials issued by a PIV-I provider whose PIV-I certificate policy maps to the Federal Bridge PIV-I Certificate Policy. A PIV-I provider is cross-certified with the FBCA (directly or through another PKI bridge) with policies that have been mapped and approved as meeting the requirements of the PIV-I policies defined in the FBCA certificate policy.
Assessment Objective
- federated or PKI credentials that meet [Assignement: policy] are accepted;
- federated or PKI credentials that meet [Assignement: policy] are verified.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
PIV-I verification records
evidence of PIV-I credentials
PIV-I credential authorizations
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with account management responsibilities
|
|
IA-08(06) Disassociability
|
Control
Implement the following measures to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties: [Assignement: measures].
Discussion
Federated identity solutions can create increased privacy risks due to the tracking and profiling of individuals. Using identifier mapping tables or cryptographic techniques to blind credential service providers and relying parties from each other or to make identity attributes less visible to transmitting parties can reduce these privacy risks.
Assessment Objective
[Assignement: measures] to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties are implemented.
Assessment Method
Examine
Identification and authentication policy
system security plan
privacy plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
system developers
organizational personnel with account management responsibilities
|
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
Linkede sager
|