Assessment Objective

Determine if:

• authorization is received from organizational personnel or roles to assign an individual, group, role, service, or device identifier.
• an identifier that identifies an individual, group, role, service, or device is selected.
• an identifier that identifies an individual, group, role, service, or device is assigned.
• the reuse of identifiers for [Assignment: time period] is prevented.
• individual identifiers are managed by uniquely identifying each individual as [Assignment: characteristic].

Assessment Methods

Examine

• identification and authentication policy and procedures
• procedures for identifier management
• procedures for account management
• system design documentation
• list of system accounts
• list of characteristics identifying individual status
• system configuration settings
• list of identifiers generated from physical access control devices
• system security plan
• other relevant documents or records

Interview

• personnel with identifier management responsibilities
• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for supporting or implementing identifier management

Verknüpfte Vorgänge

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final