+IA-12 Identity Proofing
---+IA-12(01) Supervisor Authorization
---+IA-12(02) Identity Evidence
---+IA-12(03) Identity Evidence Validation and Verification
---+IA-12(04) In-person Validation and Verification
---+IA-12(05) Address Confirmation
---+IA-12(06) Accept Externally-proofed Identities
|
IA-12 Identity Proofing
Control
- Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines;
- Resolve user identities to a unique individual; and
- Collect, validate, and verify identity evidence.
Discussion
Identity proofing is the process of collecting, validating, and verifying a user’s identity information for the purposes of establishing credentials for accessing a system. Identity proofing is intended to mitigate threats to the registration of users and the establishment of their accounts. Standards and guidelines specifying identity assurance levels for identity proofing include [SP 800-63-3](#737513fa-6758-403f-831d-5ddab5e23cb3) and [SP 800-63A](#9099ed2c-922a-493d-bcb4-d896192243ff) . Organizations may be subject to laws, executive orders, directives, regulations, or policies that address the collection of identity evidence. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.
Assessment Objective
- users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity proofed;
- user identities are resolved to a unique individual;
- identity evidence is collected;
- identity evidence is validated;
- identity evidence is verified.
Assessment Method
Examine
Identification and authentication policy
procedures addressing identity proofing
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security and privacy responsibilities
legal counsel
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
1. Panoramica
| Titolo |
Standard |
|
IA-12(01) Supervisor Authorization
|
Control
Require that the registration process to receive an account for logical access includes supervisor or sponsor authorization.
Discussion
Including supervisor or sponsor authorization as part of the registration process provides an additional level of scrutiny to ensure that the user’s management chain is aware of the account, the account is essential to carry out organizational missions and functions, and the user’s privileges are appropriate for the anticipated responsibilities and authorities within the organization.
Assessment Objective
the registration process to receive an account for logical access includes supervisor or sponsor authorization.
Assessment Method
Examine
Identification and authentication policy
procedures addressing identity proofing
system security plan
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
|
|
IA-12(02) Identity Evidence
|
Control
Require evidence of individual identification be presented to the registration authority.
Discussion
Identity evidence, such as documentary evidence or a combination of documents and biometrics, reduces the likelihood of individuals using fraudulent identification to establish an identity or at least increases the work factor of potential adversaries. The forms of acceptable evidence are consistent with the risks to the systems, roles, and privileges associated with the user’s account.
Assessment Objective
evidence of individual identification is presented to the registration authority.
Assessment Method
Examine
Identification and authentication policy
procedures addressing identity proofing
system security plan
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
|
|
IA-12(03) Identity Evidence Validation and Verification
|
Control
Require that the presented identity evidence be validated and verified through [Assignement: methods of validation and verification].
Discussion
Validation and verification of identity evidence increases the assurance that accounts and identifiers are being established for the correct user and authenticators are being bound to that user. Validation refers to the process of confirming that the evidence is genuine and authentic, and the data contained in the evidence is correct, current, and related to an individual. Verification confirms and establishes a linkage between the claimed identity and the actual existence of the user presenting the evidence. Acceptable methods for validating and verifying identity evidence are consistent with the risks to the systems, roles, and privileges associated with the users account.
Assessment Objective
the presented identity evidence is validated and verified through [Assignement: methods of validation and verification].
Assessment Method
Examine
Identification and authentication policy
procedures addressing identity proofing
system security plan
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
|
|
IA-12(04) In-person Validation and Verification
|
Control
Require that the validation and verification of identity evidence be conducted in person before a designated registration authority.
Discussion
In-person proofing reduces the likelihood of fraudulent credentials being issued because it requires the physical presence of individuals, the presentation of physical identity documents, and actual face-to-face interactions with designated registration authorities.
Assessment Objective
the validation and verification of identity evidence is conducted in person before a designated registration authority.
Assessment Method
Examine
Identification and authentication policy
procedures addressing identity proofing
system security plan
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
|
|
IA-12(05) Address Confirmation
|
Control
Require that a [Selection: registration code; notice of proofing] be delivered through an out-of-band channel to verify the users address (physical or digital) of record.
Discussion
To make it more difficult for adversaries to pose as legitimate users during the identity proofing process, organizations can use out-of-band methods to ensure that the individual associated with an address of record is the same individual that participated in the registration. Confirmation can take the form of a temporary enrollment code or a notice of proofing. The delivery address for these artifacts is obtained from records and not self-asserted by the user. The address can include a physical or digital address. A home address is an example of a physical address. Email addresses and telephone numbers are examples of digital addresses.
Assessment Objective
a [Selection: registration code; notice of proofing] is delivered through an out-of-band channel to verify the user’s address (physical or digital) of record.
Assessment Method
Examine
Identification and authentication policy
procedures addressing identity proofing
system security plan
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
|
|
IA-12(06) Accept Externally-proofed Identities
|
Control
Accept externally-proofed identities at [Assignement: identity assurance level].
Discussion
To limit unnecessary re-proofing of identities, particularly of non-PIV users, organizations accept proofing conducted at a commensurate level of assurance by other agencies or organizations. Proofing is consistent with organizational security policy and the identity assurance level appropriate for the system, application, or information accessed. Accepting externally-proofed identities is a fundamental component of managing federated identities across agencies and organizations.
Assessment Objective
externally proofed identities are accepted [Assignement: identity assurance level].
Assessment Method
Examine
Identification and authentication policy
procedures addressing identity proofing
system security plan
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
|
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Regolamentazioni correlate
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Regolamentazioni correlate
Regolamentazioni
| Fonte |
Regolamentazione |
Ticket collegati
|