Assessment Objective

Determine if:

• the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution is verified.
• initial authenticator content for any authenticators issued by the organization is established.
• administrative procedures for initial authenticator distribution are established.
• administrative procedures for lost, compromised, or damaged authenticators are established.
• administrative procedures for revoking authenticators are established.
• administrative procedures for initial authenticator distribution are implemented.
• administrative procedures for lost, compromised, or damaged authenticators are implemented.
• administrative procedures for revoking authenticators are implemented.
• default authenticators are changed at first use.
• authenticators are changed or refreshed [Assignment: frequency] or when the following events occur: [Assignment: events].
• authenticator content is protected from unauthorized disclosure.
• authenticator content is protected from unauthorized modification.

Assessment Methods

Examine

• identification and authentication policy and procedures
• procedures for authenticator management
• system configuration settings
• list of system authenticator types
• system design documentation
• system audit records
• change control records associated with managing system authenticators
• system security plan
• other relevant documents or records

Interview

• personnel with authenticator management responsibilities
• personnel with information security responsibilities
• system administrators

Test

• mechanisms for supporting or implementing the authenticator management capability

Saincheisteanna nasctha

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final