CyberStrikeus/CyberStrike - Page 126

ia-5-1-password-based-authentication

For password-based authentication: Maintain a list of commonly-used, expected, or compromised passwords and update the list [organization-defined] and

ia-5-10-dynamic-credential-binding

Bind identities and authenticators dynamically using the following rules: [organization-defined].

ia-5-11-hardware-token-based-authentication

Hardware Token-based Authentication

ia-5-12-biometric-authentication-performance

For biometric-based authentication, employ mechanisms that satisfy the following biometric quality requirements [organization-defined].

ia-5-13-expiration-of-cached-authenticators

Prohibit the use of cached authenticators after [organization-defined].

ia-5-14-managing-content-of-pki-trust-stores

For PKI-based authentication, employ an organization-wide methodology for managing the content of PKI trust stores installed across all platforms, inc

ia-5-15-gsa-approved-products-and-services

Use only General Services Administration-approved products and services for identity, credential, and access management.

ia-5-18-password-managers

Employ [organization-defined] to generate and manage passwords;

ia-5-2-public-key-based-authentication

For public key-based authentication: Enforce authorized access to the corresponding private key; and Map the authenticated identity to the account of

ia-5-3-in-person-or-trusted-external-party-registration

In-person or Trusted External Party Registration

ia-5-4-automated-support-for-password-strength-determination

Automated Support for Password Strength Determination

ia-5-5-change-authenticators-prior-to-delivery

Require developers and installers of system components to provide unique authenticators or change default authenticators prior to delivery and install

ia-5-6-protection-of-authenticators

Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.

ia-5-7-no-embedded-unencrypted-static-authenticators

Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage.

ia-5-8-multiple-system-accounts

Implement [organization-defined] to manage the risk of compromise due to individuals having accounts on multiple systems.

ia-5-9-federated-credential-management

Use the following external organizations to federate credentials: [organization-defined].

ia-5-authenticator-management

Manage system authenticators by: Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, o

ia-6-authentication-feedback

Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unau

ia-7-cryptographic-module-authentication

Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, executive orders, directives, policie

ia-8-1-acceptance-of-piv-credentials-from-other-agencies

Accept and electronically verify Personal Identity Verification-compliant credentials from other federal agencies.

ia-8-2-acceptance-of-external-authenticators

Accept only external authenticators that are NIST-compliant;

ia-8-3-use-of-ficam-approved-products

Use of FICAM-approved Products

ia-8-4-use-of-defined-profiles

Conform to the following profiles for identity management [organization-defined].

ia-8-5-acceptance-of-piv-i-credentials

Accept and verify federated or PKI credentials that meet [organization-defined].

ia-8-6-disassociability

Implement the following measures to disassociate user attributes or identifier assertion relationships among individuals, credential service providers

ia-8-identification-and-authentication-non-organizational-users

Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.

ia-9-1-information-exchange

Information Exchange

ia-9-2-transmission-of-decisions

Transmission of Decisions

ia-9-service-identification-and-authentication

Uniquely identify and authenticate [organization-defined] before establishing communications with devices, users, or other services or applications.

ir-1-policy-and-procedures

Develop, document, and disseminate to [organization-defined]: [organization-defined] incident response policy that: Procedures to facilitate the imple

ir-10-integrated-information-security-analysis-team

Integrated Information Security Analysis Team

ir-2-1-simulated-events

Incorporate simulated events into incident response training to facilitate the required response by personnel in crisis situations.

ir-2-2-automated-training-environments

Provide an incident response training environment using [organization-defined].

ir-2-3-breach

Provide incident response training on how to identify and respond to a breach, including the organization’s process for reporting a breach.

ir-2-incident-response-training

Provide incident response training to system users consistent with assigned roles and responsibilities: Within [organization-defined] of assuming an i

ir-3-1-automated-testing

Test the incident response capability using [organization-defined].

ir-3-2-coordination-with-related-plans

Coordinate incident response testing with organizational elements responsible for related plans.

ir-3-3-continuous-improvement

Use qualitative and quantitative data from testing to: Determine the effectiveness of incident response processes; Continuously improve incident respo

ir-3-incident-response-testing

Test the effectiveness of the incident response capability for the system [organization-defined] using the following tests: [organization-defined].

ir-4-1-automated-incident-handling-processes

Support the incident handling process using [organization-defined].