+IA-12 [M] Identity Proofing
---+IA-12(02) [M] Identity Evidence
---+IA-12(03) [M] Identity Evidence Validation and Verification
---+IA-12(05) [M] Address Confirmation
|
IA-12 [M] Identity Proofing
Control
- Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines;
- Resolve user identities to a unique individual; and
- Collect, validate, and verify identity evidence.
Discussion
Identity proofing is the process of collecting, validating, and verifying a user’s identity information for the purposes of establishing credentials for accessing a system. Identity proofing is intended to mitigate threats to the registration of users and the establishment of their accounts. Standards and guidelines specifying identity assurance levels for identity proofing include [SP 800-63-3](#737513fa-6758-403f-831d-5ddab5e23cb3) and [SP 800-63A](#9099ed2c-922a-493d-bcb4-d896192243ff) . Organizations may be subject to laws, executive orders, directives, regulations, or policies that address the collection of identity evidence. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.
Assessment Objective
- users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity proofed;
- user identities are resolved to a unique individual;
- identity evidence is collected;
- identity evidence is validated;
- identity evidence is verified.
Assessment Method
Examine
Identification and authentication policy
procedures addressing identity proofing
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security and privacy responsibilities
legal counsel
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
1. Pārskats
| Nosaukums |
Standarts |
|
IA-12(02) [M] Identity Evidence
|
Control
Require evidence of individual identification be presented to the registration authority.
Discussion
Identity evidence, such as documentary evidence or a combination of documents and biometrics, reduces the likelihood of individuals using fraudulent identification to establish an identity or at least increases the work factor of potential adversaries. The forms of acceptable evidence are consistent with the risks to the systems, roles, and privileges associated with the user’s account.
Assessment Objective
evidence of individual identification is presented to the registration authority.
Assessment Method
Examine
Identification and authentication policy
procedures addressing identity proofing
system security plan
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
|
|
IA-12(03) [M] Identity Evidence Validation and Verification
|
Control
Require that the presented identity evidence be validated and verified through [Assignement: methods of validation and verification].
Discussion
Validation and verification of identity evidence increases the assurance that accounts and identifiers are being established for the correct user and authenticators are being bound to that user. Validation refers to the process of confirming that the evidence is genuine and authentic, and the data contained in the evidence is correct, current, and related to an individual. Verification confirms and establishes a linkage between the claimed identity and the actual existence of the user presenting the evidence. Acceptable methods for validating and verifying identity evidence are consistent with the risks to the systems, roles, and privileges associated with the users account.
Assessment Objective
the presented identity evidence is validated and verified through [Assignement: methods of validation and verification].
Assessment Method
Examine
Identification and authentication policy
procedures addressing identity proofing
system security plan
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
|
|
IA-12(05) [M] Address Confirmation
|
Control
Require that a [Selection: registration code; notice of proofing] be delivered through an out-of-band channel to verify the users address (physical or digital) of record.
Discussion
To make it more difficult for adversaries to pose as legitimate users during the identity proofing process, organizations can use out-of-band methods to ensure that the individual associated with an address of record is the same individual that participated in the registration. Confirmation can take the form of a temporary enrollment code or a notice of proofing. The delivery address for these artifacts is obtained from records and not self-asserted by the user. The address can include a physical or digital address. A home address is an example of a physical address. Email addresses and telephone numbers are examples of digital addresses.
Assessment Objective
a [Selection: registration code; notice of proofing] is delivered through an out-of-band channel to verify the user’s address (physical or digital) of record.
Assessment Method
Examine
Identification and authentication policy
procedures addressing identity proofing
system security plan
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
|
1.1 Atsauces
1.2 Identificētās prasības
1.3 Saistītie tiesību akti
2. Identificētās prasības
3. Saistītie tiesību akti
Tiesību akti
| Avots |
Regulējums |
Saistītie uzdevumi
|