+IA-08 [H] Identification and Authentication (Non-organizational Users)
---+IA-08(01) [H] Acceptance of PIV Credentials from Other Agencies
---+IA-08(02) [H] Acceptance of External Authenticators
---+IA-08(04) [H] Use of Defined Profiles
|
IA-08 [H] Identification and Authentication (Non-organizational Users)
Control
Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
Discussion
Non-organizational users include system users other than organizational users explicitly covered by [IA-2](#ia-2) . Non-organizational users are uniquely identified and authenticated for accesses other than those explicitly identified and documented in [AC-14](#ac-14) . Identification and authentication of non-organizational users accessing federal systems may be required to protect federal, proprietary, or privacy-related information (with exceptions noted for national security systems). Organizations consider many factors—including security, privacy, scalability, and practicality—when balancing the need to ensure ease of use for access to federal information and systems with the need to protect and adequately mitigate risk.
Assessment Objective
non-organizational users or processes acting on behalf of non-organizational users are uniquely identified and authenticated.
Assessment Method
Examine
Identification and authentication policy
system security plan
privacy plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
list of system accounts
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
organizational personnel with account management responsibilities
1. Yleiskatsaus
| Otsikko |
Standardi |
|
IA-08(01) [H] Acceptance of PIV Credentials from Other Agencies
|
Control
Accept and electronically verify Personal Identity Verification-compliant credentials from other federal agencies.
Discussion
Acceptance of Personal Identity Verification (PIV) credentials from other federal agencies applies to both logical and physical access control systems. PIV credentials are those credentials issued by federal agencies that conform to FIPS Publication 201 and supporting guidelines. The adequacy and reliability of PIV card issuers are addressed and authorized using [SP 800-79-2](#10963761-58fc-4b20-b3d6-b44a54daba03).
Assessment Objective
- Personal Identity Verification-compliant credentials from other federal agencies are accepted;
- Personal Identity Verification-compliant credentials from other federal agencies are electronically verified.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
PIV verification records
evidence of PIV credentials
PIV credential authorizations
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with account management responsibilities
|
|
IA-08(02) [H] Acceptance of External Authenticators
|
Control
- Accept only external authenticators that are NIST-compliant; and
- Document and maintain a list of accepted external authenticators.
Discussion
Acceptance of only NIST-compliant external authenticators applies to organizational systems that are accessible to the public (e.g., public-facing websites). External authenticators are issued by nonfederal government entities and are compliant with [SP 800-63B](#e59c5a7c-8b1f-49ca-8de0-6ee0882180ce) . Approved external authenticators meet or exceed the minimum Federal Government-wide technical, security, privacy, and organizational maturity requirements. Meeting or exceeding Federal requirements allows Federal Government relying parties to trust external authenticators in connection with an authentication transaction at a specified authenticator assurance level.
Assessment Objective
- only external authenticators that are NIST-compliant are accepted;
- a list of accepted external authenticators is documented;
- a list of accepted external authenticators is maintained.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
list of third-party credentialing products, components, or services procured and implemented by organization
third-party credential verification records
evidence of third-party credentials
third-party credential authorizations
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with account management responsibilities
|
|
IA-08(04) [H] Use of Defined Profiles
|
Control
Conform to the following profiles for identity management [Assignement: identity management profiles].
Discussion
Organizations define profiles for identity management based on open identity management standards. To ensure that open identity management standards are viable, robust, reliable, sustainable, and interoperable as documented, the Federal Government assesses and scopes the standards and technology implementations against applicable laws, executive orders, directives, policies, regulations, standards, and guidelines.
Assessment Objective
there is conformance with [Assignement: identity management profiles] for identity management.
Assessment Method
Examine
Identification and authentication policy
system security plan
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with account management responsibilities
|
1.1 Viittaukset
1.2 Tunnistetut vaatimukset
1.3 Liittyvät säädökset
2. Tunnistetut vaatimukset
Vaatimukset
| Lähde |
Vaatimus |
3. Liittyvät säädökset
Linkitetyt tehtävät
|