PR.AA Identity Management, Authentication, and Access Control

Statement

Identities and credentials for authorized users, services, and hardware are managed by the organization

Guidance

Initiate requests for new access or additional access for employees, contractors, and others, and track, review, and fulfill the requests, with permission from system or data owners when needed

Guidance

Issue, manage, and revoke cryptographic certificates and identity tokens, cryptographic keys (i.e., key management), and other credentials

Guidance

Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device

Guidance

Physically label authorized hardware with an identifier for inventory and servicing purposes

Statement

Identities are proofed and bound to credentials based on the context of interactions

Guidance

Verify a person's claimed identity at enrollment time using government-issued identity credentials (e.g., passport, visa, driver's license)

Guidance

Issue a different credential for each person (i.e., no credential sharing)

Statement

Users, services, and hardware are authenticated

Guidance

Require multifactor authentication

Guidance

Enforce policies for the minimum strength of passwords, PINs, and similar authenticators

Guidance

Periodically reauthenticate users, services, and hardware based on risk (e.g., in zero trust architectures)

Guidance

Ensure that authorized personnel can access accounts essential for protecting safety under emergency conditions

Statement

Identity assertions are protected, conveyed, and verified

Guidance

Protect identity assertions that are used to convey authentication and user information through single sign-on systems

Guidance

Protect identity assertions that are used to convey authentication and user information between federated systems

Guidance

Implement standards-based approaches for identity assertions in all contexts, and follow all guidance for the generation (e.g., data models, metadata), protection (e.g., digital signing, encryption), and verification (e.g., signature validation) of identity assertions

Statement

Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

Guidance

Review logical and physical access privileges periodically and whenever someone changes roles or leaves the organization, and promptly rescind privileges that are no longer needed

Guidance

Take attributes of the requester and the requested resource into account for authorization decisions (e.g., geolocation, day/time, requester endpoint's cyber health)

Guidance

Restrict access and privileges to the minimum necessary (e.g., zero trust architecture)

Guidance

Periodically review the privileges associated with critical business functions to confirm proper separation of duties

Statement

Physical access to assets is managed, monitored, and enforced commensurate with risk

Guidance

Use security guards, security cameras, locked entrances, alarm systems, and other physical controls to monitor facilities and restrict access

Guidance

Employ additional physical security controls for areas that contain high-risk assets

Guidance

Escort guests, vendors, and other third parties within areas that contain business-critical assets