Assessment Objective

Determine if:

• IA-04a. system identifiers are managed by receiving authorization from [Assignment: personnel or roles] to assign to an individual, group, role, or device identifier;
• IA-04b. system identifiers are managed by selecting an identifier that identifies an individual, group, role, service, or device;
• IA-04c. system identifiers are managed by assigning the identifier to the intended individual, group, role, service, or device;
• IA-04d. system identifiers are managed by preventing reuse of identifiers for [Assignment: time period].

Assessment Methods

Examine

• Identification and authentication policy
• procedures addressing identifier management
• procedures addressing account management
• system security plan
• system design documentation
• system configuration settings and associated documentation
• list of system accounts
• list of identifiers generated from physical access control devices
• other relevant documents or records

Interview

• Organizational personnel with identifier management responsibilities
• organizational personnel with information security responsibilities
• system/network administrators
• system developers

Test

• Mechanisms supporting and/or implementing identifier management

Gekoppelde issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final