Assessment Objective

Determine if:

• IA-05(02)(a)
  • IA-05(02)(a)(01) authorized access to the corresponding private key is enforced for public key-based authentication;
  • IA-05(02)(a)(02) the authenticated identity is mapped to the account of the individual or group for public key-based authentication;
• IA-05(02)(b)
  • IA-05(02)(b)(01) when public key infrastructure (PKI) is used, certificates are validated by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information;
  • IA-05(02)(b)(02) when public key infrastructure (PKI) is used, a local cache of revocation data is implemented to support path discovery and validation.

Assessment Methods

Examine

• Identification and authentication policy
• procedures addressing authenticator management
• system security plan
• system design documentation
• system configuration settings and associated documentation
• PKI certification validation records
• PKI certification revocation lists
• other relevant documents or records

Interview

• Organizational personnel with PKI-based, authenticator management responsibilities
• organizational personnel with information security responsibilities
• system/network administrators
• system developers

Test

• Mechanisms supporting and/or implementing PKI-based, authenticator management capability

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final