Assessment Objective

Determine if:

• IA-05a. system authenticators are managed through the verification of the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution;
• IA-05b. system authenticators are managed through the establishment of initial authenticator content for any authenticators issued by the organization;
• IA-05c. system authenticators are managed to ensure that authenticators have sufficient strength of mechanism for their intended use;
• IA-05d. system authenticators are managed through the establishment and implementation of administrative procedures for initial authenticator distribution; lost, compromised, or damaged authenticators; and the revocation of authenticators;
• IA-05e. system authenticators are managed through the change of default authenticators prior to first use;
• IA-05f. system authenticators are managed through the change or refreshment of authenticators [Assignment: time period by authenticator type] or when [Assignment: events] occur;
• IA-05g. system authenticators are managed through the protection of authenticator content from unauthorized disclosure and modification;
• IA-05h.
  • IA-05h.[01] system authenticators are managed through the requirement for individuals to take specific controls to protect authenticators;
  • IA-05h.[02] system authenticators are managed through the requirement for devices to implement specific controls to protect authenticators;
• IA-05i. system authenticators are managed through the change of authenticators for group or role accounts when membership to those accounts changes.

Assessment Methods

Examine

• Identification and authentication policy
• system security plan
• addressing authenticator management
• system design documentation
• system configuration settings and associated documentation
• list of system authenticator types
• change control records associated with managing system authenticators
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with authenticator management responsibilities
• organizational personnel with information security responsibilities
• system/network administrators

Test

• Mechanisms supporting and/or implementing authenticator management capability

Saincheisteanna nasctha

• NIST -

  EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

  DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.