03.05.01 User Identification and Authentication

Statement

• a. Uniquely identify and authenticate system users, and associate that unique identification with processes acting on behalf of those users.

• b. Re-authenticate users when {{ insert: param, A.03.05.01.ODP.01 }} .

Guidance

System users include individuals (or system processes acting on behalf of individuals) who are authorized to access a system. Typically, individual identifiers are the usernames associated with the system accounts assigned to those individuals. Since system processes execute on behalf of groups and roles, organizations may require the unique identification of individuals in group accounts or the accountability of individual activity. The unique identification and authentication of users apply to all system accesses. Organizations use passwords, physical authenticators, biometrics, or some combination thereof to authenticate user identities. Organizations may re-authenticate individuals in certain situations, including when roles, authenticators, or credentials change; when the execution of privileged functions occurs; after a fixed time period; or periodically.

Assessment objective

system users are uniquely identified.

Assessment objective

system users are authenticated.

Assessment objective

processes acting on behalf of users are associated with uniquely identified and authenticated system users.

Assessment objective

users are reauthenticated when {{ insert: param, A.03.05.01.ODP.01 }} .

Assessment method

• identification and authentication policy and procedures list of circumstances or situations requiring re-authentication system design documentation system configuration settings system audit records list of system accounts system security plan other relevant documents or records

Assessment method

• personnel with identification and authentication responsibilities personnel with system operations responsibilities personnel with account management responsibilities system developers personnel with information security responsibilities system administrators

Assessment method

• processes for uniquely identifying and authenticating users mechanisms for supporting or implementing identification and authentication capabilities

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final