+IA Identification and Authentication
---+IA-01 Policy and Procedures
---+IA-02 Identification and Authentication (Organizational Users)
------+IA-02(01) Multi-factor Authentication to Privileged Accounts
------+IA-02(02) Multi-factor Authentication to Non-privileged Accounts
------+IA-02(05) Individual Authentication with Group Authentication
------+IA-02(06) Access to Accounts —separate Device
------+IA-02(08) Access to Accounts — Replay Resistant
------+IA-02(10) Single Sign-on
------+IA-02(12) Acceptance of PIV Credentials
------+IA-02(13) Out-of-band Authentication
---+IA-03 Device Identification and Authentication
------+IA-03(01) Cryptographic Bidirectional Authentication
------+IA-03(03) Dynamic Address Allocation
------+IA-03(04) Device Attestation
---+IA-04 Identifier Management
------+IA-04(01) Prohibit Account Identifiers as Public Identifiers
------+IA-04(04) Identify User Status
------+IA-04(05) Dynamic Management
------+IA-04(06) Cross-organization Management
------+IA-04(08) Pairwise Pseudonymous Identifiers
------+IA-04(09) Attribute Maintenance and Protection
---+IA-05 Authenticator Management
------+IA-05(01) Password-based Authentication
------+IA-05(02) Public Key-based Authentication
------+IA-05(05) Change Authenticators Prior to Delivery
------+IA-05(06) Protection of Authenticators
------+IA-05(07) No Embedded Unencrypted Static Authenticators
------+IA-05(08) Multiple System Accounts
------+IA-05(09) Federated Credential Management
------+IA-05(10) Dynamic Credential Binding
------+IA-05(12) Biometric Authentication Performance
------+IA-05(13) Expiration of Cached Authenticators
------+IA-05(14) Managing Content of PKI Trust Stores
------+IA-05(15) GSA-approved Products and Services
------+IA-05(16) In-person or Trusted External Party Authenticator Issuance
------+IA-05(17) Presentation Attack Detection for Biometric Authenticators
------+IA-05(18) Password Managers
---+IA-06 Authentication Feedback
---+IA-07 Cryptographic Module Authentication
---+IA-08 Identification and Authentication (Non-organizational Users)
------+IA-08(01) Acceptance of PIV Credentials from Other Agencies
------+IA-08(02) Acceptance of External Authenticators
------+IA-08(04) Use of Defined Profiles
------+IA-08(05) Acceptance of PIV-I Credentials
------+IA-08(06) Disassociability
---+IA-09 Service Identification and Authentication
---+IA-10 Adaptive Authentication
---+IA-11 Re-authentication
---+IA-12 Identity Proofing
------+IA-12(01) Supervisor Authorization
------+IA-12(02) Identity Evidence
------+IA-12(03) Identity Evidence Validation and Verification
------+IA-12(04) In-person Validation and Verification
------+IA-12(05) Address Confirmation
------+IA-12(06) Accept Externally-proofed Identities
---+IA-13 Identity Providers and Authorization Servers
------+IA-13(01) Protection of Cryptographic Keys
------+IA-13(02) Verification of Identity Assertions and Access Tokens
------+IA-13(03) Token Management
|
IA Identification and Authentication
Identification and Authentication
1. Przegląd
| Tytuł |
Norma |
|
IA-01 Policy and Procedures
|
Control
- Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
- [Selection(one-or-more): organization-level; mission/business process-level; system-level] identification and authentication policy that:
- Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
- Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
- Procedures to facilitate the implementation of the identification and authentication policy and the associated identification and authentication controls;
- Designate an [Assignement: official] to manage the development, documentation, and dissemination of the identification and authentication policy and procedures; and
- Review and update the current identification and authentication:
- Policy [Assignement: frequency] and following [Assignement: events] ; and
- Procedures [Assignement: frequency] and following [Assignement: events].
Discussion
Identification and authentication policy and procedures address the controls in the IA family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of identification and authentication policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to identification and authentication policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
Assessment Objective
- an identification and authentication policy is developed and documented;
- the identification and authentication policy is disseminated to [Assignement: personnel or roles];
- identification and authentication procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls are developed and documented;
- the identification and authentication procedures are disseminated to [Assignement: personnel or roles];
- the [Selection(one-or-more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses purpose;
- the [Selection(one-or-more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses scope;
- the [Selection(one-or-more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses roles;
- the [Selection(one-or-more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses responsibilities;
- the [Selection(one-or-more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses management commitment;
- the [Selection(one-or-more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses coordination among organizational entities;
- the [Selection(one-or-more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses compliance;
- the [Selection(one-or-more): organization-level; mission/business process-level; system-level] identification and authentication policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
- the [Assignement: official] is designated to manage the development, documentation, and dissemination of the identification and authentication policy and procedures;
- the current identification and authentication policy is reviewed and updated [Assignement: frequency];
- the current identification and authentication policy is reviewed and updated following [Assignement: events];
- the current identification and authentication procedures are reviewed and updated [Assignement: frequency];
- the current identification and authentication procedures are reviewed and updated following [Assignement: events].
Assessment Method
Examine
Identification and authentication policy and procedures
system security plan
privacy plan
risk management strategy documentation
list of events requiring identification and authentication procedures to be reviewed and updated (e.g., audit findings)
other relevant documents or records
Interview
Organizational personnel with identification and authentication responsibilities
organizational personnel with information security and privacy responsibilities
|
|
IA-02 Identification and Authentication (Organizational Users)
|
Control
Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
Discussion
Organizations can satisfy the identification and authentication requirements by complying with the requirements in [HSPD 12](#f16e438e-7114-4144-bfe2-2dfcad8cb2d0) . Organizational users include employees or individuals who organizations consider to have an equivalent status to employees (e.g., contractors and guest researchers). Unique identification and authentication of users applies to all accesses other than those that are explicitly identified in [AC-14](#ac-14) and that occur through the authorized use of group authenticators without individual authentication. Since processes execute on behalf of groups and roles, organizations may require unique identification of individuals in group accounts or for detailed accountability of individual activity.
Organizations employ passwords, physical authenticators, or biometrics to authenticate user identities or, in the case of multi-factor authentication, some combination thereof. Access to organizational systems is defined as either local access or network access. Local access is any access to organizational systems by users or processes acting on behalf of users, where access is obtained through direct connections without the use of networks. Network access is access to organizational systems by users (or processes acting on behalf of users) where access is obtained through network connections (i.e., nonlocal accesses). Remote access is a type of network access that involves communication through external networks. Internal networks include local area networks and wide area networks.
The use of encrypted virtual private networks for network connections between organization-controlled endpoints and non-organization-controlled endpoints may be treated as internal networks with respect to protecting the confidentiality and integrity of information traversing the network. Identification and authentication requirements for non-organizational users are described in [IA-8](#ia-8).
Assessment Objective
- organizational users are uniquely identified and authenticated;
- the unique identification of authenticated organizational users is associated with processes acting on behalf of those users.
Assessment Method
Examine
Identification and authentication policy
procedures addressing user identification and authentication
system security plan, system design documentation
system configuration settings and associated documentation
system audit records
list of system accounts
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
organizational personnel with account management responsibilities
system developers
|
|
IA-03 Device Identification and Authentication
|
Control
Uniquely identify and authenticate [Assignement: devices and/or types of devices] before establishing a [Selection(one-or-more): local; remote; network] connection.
Discussion
Devices that require unique device-to-device identification and authentication are defined by type, device, or a combination of type and device. Organization-defined device types include devices that are not owned by the organization. Systems use shared known information (e.g., Media Access Control [MAC], Transmission Control Protocol/Internet Protocol [TCP/IP] addresses) for device identification or organizational authentication solutions (e.g., Institute of Electrical and Electronics Engineers (IEEE) 802.1x and Extensible Authentication Protocol [EAP], RADIUS server with EAP-Transport Layer Security [TLS] authentication, Kerberos) to identify and authenticate devices on local and wide area networks. Organizations determine the required strength of authentication mechanisms based on the security categories of systems and mission or business requirements. Because of the challenges of implementing device authentication on a large scale, organizations can restrict the application of the control to a limited number/type of devices based on mission or business needs.
Assessment Objective
[Assignement: devices and/or types of devices] are uniquely identified and authenticated before establishing a [Selection(one-or-more): local; remote; network] connection.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing device identification and authentication
system design documentation
list of devices requiring unique identification and authentication
device connection reports
system configuration settings and associated documentation
other relevant documents or records
Interview
Organizational personnel with operational responsibilities for device identification and authentication
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
IA-04 Identifier Management
|
Control
Manage system identifiers by:- Receiving authorization from [Assignement: personnel or roles] to assign an individual, group, role, service, or device identifier;
- Selecting an identifier that identifies an individual, group, role, service, or device;
- Assigning the identifier to the intended individual, group, role, service, or device; and
- Preventing reuse of identifiers for [Assignement: time period].
Discussion
Common device identifiers include Media Access Control (MAC) addresses, Internet Protocol (IP) addresses, or device-unique token identifiers. The management of individual identifiers is not applicable to shared system accounts. Typically, individual identifiers are the usernames of the system accounts assigned to those individuals. In such instances, the account management activities of [AC-2](#ac-2) use account names provided by [IA-4](#ia-4) . Identifier management also addresses individual identifiers not necessarily associated with system accounts. Preventing the reuse of identifiers implies preventing the assignment of previously used individual, group, role, service, or device identifiers to different individuals, groups, roles, services, or devices.
Assessment Objective
- system identifiers are managed by receiving authorization from [Assignement: personnel or roles] to assign to an individual, group, role, or device identifier;
- system identifiers are managed by selecting an identifier that identifies an individual, group, role, service, or device;
- system identifiers are managed by assigning the identifier to the intended individual, group, role, service, or device;
- system identifiers are managed by preventing reuse of identifiers for [Assignement: time period].
Assessment Method
Examine
Identification and authentication policy
procedures addressing identifier management
procedures addressing account management
system security plan
system design documentation
system configuration settings and associated documentation
list of system accounts
list of identifiers generated from physical access control devices
other relevant documents or records
Interview
Organizational personnel with identifier management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
IA-05 Authenticator Management
|
Control
Manage system authenticators by:- Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator;
- Establishing initial authenticator content for any authenticators issued by the organization;
- Ensuring that authenticators have sufficient strength of mechanism for their intended use;
- Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators;
- Changing default authenticators prior to first use;
- Changing or refreshing authenticators [Assignement: time period by authenticator type] or when [Assignement: events] occur;
- Protecting authenticator content from unauthorized disclosure and modification;
- Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and
- Changing authenticators for group or role accounts when membership to those accounts changes.
Discussion
Authenticators include passwords, cryptographic devices, biometrics, certificates, one-time password devices, and ID badges. Device authenticators include certificates and passwords. Initial authenticator content is the actual content of the authenticator (e.g., the initial password). In contrast, the requirements for authenticator content contain specific criteria or characteristics (e.g., minimum password length). Developers may deliver system components with factory default authentication credentials (i.e., passwords) to allow for initial installation and configuration. Default authentication credentials are often well known, easily discoverable, and present a significant risk. The requirement to protect individual authenticators may be implemented via control [PL-4](#pl-4) or [PS-6](#ps-6) for authenticators in the possession of individuals and by controls [AC-3](#ac-3), [AC-6](#ac-6) , and [SC-28](#sc-28) for authenticators stored in organizational systems, including passwords stored in hashed or encrypted formats or files containing encrypted or hashed passwords accessible with administrator privileges.
Systems support authenticator management by organization-defined settings and restrictions for various authenticator characteristics (e.g., minimum password length, validation time window for time synchronous one-time tokens, and number of allowed rejections during the verification stage of biometric authentication). Actions can be taken to safeguard individual authenticators, including maintaining possession of authenticators, not sharing authenticators with others, and immediately reporting lost, stolen, or compromised authenticators. Authenticator management includes issuing and revoking authenticators for temporary access when no longer needed.
Assessment Objective
- system authenticators are managed through the verification of the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution;
- system authenticators are managed through the establishment of initial authenticator content for any authenticators issued by the organization;
- system authenticators are managed to ensure that authenticators have sufficient strength of mechanism for their intended use;
- system authenticators are managed through the establishment and implementation of administrative procedures for initial authenticator distribution; lost, compromised, or damaged authenticators; and the revocation of authenticators;
- system authenticators are managed through the change of default authenticators prior to first use;
- system authenticators are managed through the change or refreshment of authenticators [Assignement: time period by authenticator type] or when [Assignement: events] occur;
- system authenticators are managed through the protection of authenticator content from unauthorized disclosure and modification;
- system authenticators are managed through the requirement for individuals to take specific controls to protect authenticators;
- system authenticators are managed through the requirement for devices to implement specific controls to protect authenticators;
- system authenticators are managed through the change of authenticators for group or role accounts when membership to those accounts changes.
Assessment Method
Examine
Identification and authentication policy
system security plan
addressing authenticator management
system design documentation
system configuration settings and associated documentation
list of system authenticator types
change control records associated with managing system authenticators
system audit records
other relevant documents or records
Interview
Organizational personnel with authenticator management responsibilities
organizational personnel with information security responsibilities
system/network administrators
|
|
IA-06 Authentication Feedback
|
Control
Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.
Discussion
Authentication feedback from systems does not provide information that would allow unauthorized individuals to compromise authentication mechanisms. For some types of systems, such as desktops or notebooks with relatively large monitors, the threat (referred to as shoulder surfing) may be significant. For other types of systems, such as mobile devices with small displays, the threat may be less significant and is balanced against the increased likelihood of typographic input errors due to small keyboards. Thus, the means for obscuring authentication feedback is selected accordingly. Obscuring authentication feedback includes displaying asterisks when users type passwords into input devices or displaying feedback for a very limited time before obscuring it.
Assessment Objective
the feedback of authentication information is obscured during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing authenticator feedback
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
IA-07 Cryptographic Module Authentication
|
Control
Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication.
Discussion
Authentication mechanisms may be required within a cryptographic module to authenticate an operator accessing the module and to verify that the operator is authorized to assume the requested role and perform services within that role.
Assessment Objective
mechanisms for authentication to a cryptographic module are implemented that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing cryptographic module authentication
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with responsibility for cryptographic module authentication
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
IA-08 Identification and Authentication (Non-organizational Users)
|
Control
Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
Discussion
Non-organizational users include system users other than organizational users explicitly covered by [IA-2](#ia-2) . Non-organizational users are uniquely identified and authenticated for accesses other than those explicitly identified and documented in [AC-14](#ac-14) . Identification and authentication of non-organizational users accessing federal systems may be required to protect federal, proprietary, or privacy-related information (with exceptions noted for national security systems). Organizations consider many factors—including security, privacy, scalability, and practicality—when balancing the need to ensure ease of use for access to federal information and systems with the need to protect and adequately mitigate risk.
Assessment Objective
non-organizational users or processes acting on behalf of non-organizational users are uniquely identified and authenticated.
Assessment Method
Examine
Identification and authentication policy
system security plan
privacy plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
list of system accounts
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
organizational personnel with account management responsibilities
|
|
IA-09 Service Identification and Authentication
|
Control
Uniquely identify and authenticate [Assignement: system services and applications] before establishing communications with devices, users, or other services or applications.
Discussion
Services that may require identification and authentication include web applications using digital certificates or services or applications that query a database. Identification and authentication methods for system services and applications include information or code signing, provenance graphs, and electronic signatures that indicate the sources of services. Decisions regarding the validity of identification and authentication claims can be made by services separate from the services acting on those decisions. This can occur in distributed system architectures. In such situations, the identification and authentication decisions (instead of actual identifiers and authentication data) are provided to the services that need to act on those decisions.
Assessment Objective
[Assignement: system services and applications] are uniquely identified and authenticated before establishing communications with devices, users, or other services or applications.
Assessment Method
Examine
Identification and authentication policy
procedures addressing service identification and authentication
system security plan
system design documentation
security safeguards used to identify and authenticate system services
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
|
|
IA-10 Adaptive Authentication
|
Control
Require individuals accessing the system to employ [Assignement: supplemental authentication techniques or mechanisms] under specific [Assignement: circumstances or situations].
Discussion
Adversaries may compromise individual authentication mechanisms employed by organizations and subsequently attempt to impersonate legitimate users. To address this threat, organizations may employ specific techniques or mechanisms and establish protocols to assess suspicious behavior. Suspicious behavior may include accessing information that individuals do not typically access as part of their duties, roles, or responsibilities; accessing greater quantities of information than individuals would routinely access; or attempting to access information from suspicious network addresses. When pre-established conditions or triggers occur, organizations can require individuals to provide additional authentication information. Another potential use for adaptive authentication is to increase the strength of mechanism based on the number or types of records being accessed. Adaptive authentication does not replace and is not used to avoid the use of multi-factor authentication mechanisms but can augment implementations of multi-factor authentication.
Assessment Objective
individuals accessing the system are required to employ [Assignement: supplemental authentication techniques or mechanisms] under specific [Assignement: circumstances or situations].
Assessment Method
Examine
Identification and authentication policy
procedures addressing adaptive/supplemental identification and authentication techniques or mechanisms
system security plan
system design documentation
system configuration settings and associated documentation
supplemental identification and authentication techniques or mechanisms
system audit records
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
|
|
IA-11 Re-authentication
|
Control
Require users to re-authenticate when [Assignement: circumstances or situations].
Discussion
In addition to the re-authentication requirements associated with device locks, organizations may require re-authentication of individuals in certain situations, including when roles, authenticators or credentials change, when security categories of systems change, when the execution of privileged functions occurs, after a fixed time period, or periodically.
Assessment Objective
users are required to re-authenticate when [Assignement: circumstances or situations].
Assessment Method
Examine
Identification and authentication policy
procedures addressing user and device re-authentication
system security plan
system design documentation
system configuration settings and associated documentation
list of circumstances or situations requiring re-authentication
system audit records
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
|
|
IA-12 Identity Proofing
|
Control
- Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines;
- Resolve user identities to a unique individual; and
- Collect, validate, and verify identity evidence.
Discussion
Identity proofing is the process of collecting, validating, and verifying a user’s identity information for the purposes of establishing credentials for accessing a system. Identity proofing is intended to mitigate threats to the registration of users and the establishment of their accounts. Standards and guidelines specifying identity assurance levels for identity proofing include [SP 800-63-3](#737513fa-6758-403f-831d-5ddab5e23cb3) and [SP 800-63A](#9099ed2c-922a-493d-bcb4-d896192243ff) . Organizations may be subject to laws, executive orders, directives, regulations, or policies that address the collection of identity evidence. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.
Assessment Objective
- users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity proofed;
- user identities are resolved to a unique individual;
- identity evidence is collected;
- identity evidence is validated;
- identity evidence is verified.
Assessment Method
Examine
Identification and authentication policy
procedures addressing identity proofing
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security and privacy responsibilities
legal counsel
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
|
|
IA-13 Identity Providers and Authorization Servers
|
Control
Employ identity providers and authorization servers to manage user, device, and non-person entity (NPE) identities, attributes, and access rights supporting authentication and authorization decisions in accordance with [Assignement: policy] using [Assignement: mechanisms].
Discussion
Identity providers, both internal and external to the organization, manage the user, device, and NPE authenticators and issue statements, often called identity assertions, attesting to identities of other systems or systems components. Authorization servers create and issue access tokens to identified and authenticated users and devices that can be used to gain access to system or information resources. For example, single sign-on (SSO) provides identity provider and authorization server functions. Authenticator management (to include credential management) is covered by IA-05.
Assessment Objective
- identity providers are employed to manage user, device, and non-person entity (NPE) identities, attributes and access rights supporting authentication decisions in accordance with [Assignement: mechanisms] using [Assignement: mechanisms];
- identity providers are employed to manage user, device, and non-person entity (NPE) identities, attributes and access rights supporting authorization decisions in accordance with [Assignement: mechanisms] using [Assignement: mechanisms];
- authorization servers are employed to manage user, device, and non-person entity (NPE) identities, attributes and access rights supporting authentication decisions in accordance with [Assignement: mechanisms] using [Assignement: mechanisms];
- authorization servers are employed to manage user, device, and non-person entity (NPE) identities, attributes and access rights supporting authorization decisions in accordance with [Assignement: mechanisms] using [Assignement: mechanisms];
Assessment Method
Examine
Identification and authentication policy;
procedures addressing user and device identification and authentication;
system security plan;
system design documentation;
system configuration settings and associated documentation;
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities;
organizational personnel with information security responsibilities;
system/network administrators;
organizational personnel with account management responsibilities;
system developers
|
1.1 Odwołania
1.2 Zidentyfikowane wymagania
1.3 Powiązane regulacje
2. Zidentyfikowane wymagania
Wymagania
| Źródło |
Wymaganie |
3. Powiązane regulacje
Regulacje
| Źródło |
Regulacja |
|