CyberStrikeus/CyberStrike - Page 125

ia-11-re-authentication

Require users to re-authenticate when [organization-defined].

ia-12-1-supervisor-authorization

Require that the registration process to receive an account for logical access includes supervisor or sponsor authorization.

ia-12-2-identity-evidence

Require evidence of individual identification be presented to the registration authority.

ia-12-3-identity-evidence-validation-and-verification

Require that the presented identity evidence be validated and verified through [organization-defined].

ia-12-4-in-person-validation-and-verification

Require that the validation and verification of identity evidence be conducted in person before a designated registration authority.

ia-12-5-address-confirmation

Require that a [organization-defined] be delivered through an out-of-band channel to verify the users address (physical or digital) of record.

ia-12-6-accept-externally-proofed-identities

Accept externally-proofed identities at [organization-defined].

ia-12-identity-proofing

Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in...

ia-13-1-protection-of-cryptographic-keys

Cryptographic keys that protect access tokens are generated, managed, and protected from disclosure and misuse.

ia-13-2-verification-of-identity-assertions-and-access-tokens

The source and integrity of identity assertions and access tokens are verified before granting access to system and information resources.

ia-13-3-token-management

In accordance with [organization-defined], assertions and access tokens are: generated; issued; refreshed; revoked; time-restricted; and audience-rest

ia-13-identity-providers-and-authorization-servers

Employ identity providers and authorization servers to manage user, device, and non-person entity (NPE) identities, attributes, and access rights supp

ia-2-1-multi-factor-authentication-to-privileged-accounts

Implement multi-factor authentication for access to privileged accounts.

ia-2-10-single-sign-on

Provide a single sign-on capability for [organization-defined].

ia-2-11-remote-access-separate-device

Remote Access — Separate Device

ia-2-12-acceptance-of-piv-credentials

Accept and electronically verify Personal Identity Verification-compliant credentials.

ia-2-13-out-of-band-authentication

Implement the following out-of-band authentication mechanisms under [organization-defined]: [organization-defined].

ia-2-2-multi-factor-authentication-to-non-privileged-accounts

Implement multi-factor authentication for access to non-privileged accounts.

ia-2-3-local-access-to-privileged-accounts

Local Access to Privileged Accounts

ia-2-4-local-access-to-non-privileged-accounts

Local Access to Non-privileged Accounts

ia-2-5-individual-authentication-with-group-authentication

When shared accounts or authenticators are employed, require users to be individually authenticated before granting access to the shared accounts or r

ia-2-6-access-to-accounts-separate-device

Implement multi-factor authentication for [organization-defined] access to [organization-defined] such that: One of the factors is provided by a devic

ia-2-7-network-access-to-non-privileged-accounts-separate-device

Network Access to Non-privileged Accounts — Separate Device

ia-2-8-access-to-accounts-replay-resistant

Implement replay-resistant authentication mechanisms for access to [organization-defined].

ia-2-identification-and-authentication-organizational-users

Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

ia-3-1-cryptographic-bidirectional-authentication

Authenticate [organization-defined] before establishing [organization-defined] connection using bidirectional authentication that is cryptographically

ia-3-2-cryptographic-bidirectional-network-authentication

Cryptographic Bidirectional Network Authentication

ia-3-3-dynamic-address-allocation

Where addresses are allocated dynamically, standardize dynamic address allocation lease information and the lease duration assigned to devices in a...

ia-3-4-device-attestation

Handle device identification and authentication based on attestation by [organization-defined].

ia-3-device-identification-and-authentication

Uniquely identify and authenticate [organization-defined] before establishing a [organization-defined] connection.

ia-4-1-prohibit-account-identifiers-as-public-identifiers

Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts.

ia-4-2-supervisor-authorization

Supervisor Authorization

ia-4-3-multiple-forms-of-certification

Multiple Forms of Certification

ia-4-4-identify-user-status

Manage individual identifiers by uniquely identifying each individual as [organization-defined].

ia-4-5-dynamic-management

Manage individual identifiers dynamically in accordance with [organization-defined].

ia-4-6-cross-organization-management

Coordinate with the following external organizations for cross-organization management of identifiers: [organization-defined].

ia-4-7-in-person-registration

In-person Registration

ia-4-8-pairwise-pseudonymous-identifiers

Generate pairwise pseudonymous identifiers.

ia-4-9-attribute-maintenance-and-protection

Maintain the attributes for each uniquely identified individual, device, or service in [organization-defined].

ia-4-identifier-management

Manage system identifiers by: Receiving authorization from [organization-defined] to assign an individual, group, role, service, or device identifier;