The organization: a. Develops, documents, and disseminates to {{ insert: param, ia-1_prm_1 }}: 1. An identification and authentication policy that addresses purpose, scope, roles, responsibil...

The information system implements multifactor authentication for network access to privileged accounts.

The information system implements multifactor authentication for network access to non-privileged accounts.

The information system implements multifactor authentication for local access to privileged accounts.

The information system implements multifactor authentication for local access to non-privileged accounts.

The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.

The information system implements multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access a...

The information system implements multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining acce...

The information system implements replay-resistant authentication mechanisms for network access to privileged accounts.

The information system implements replay-resistant authentication mechanisms for network access to non-privileged accounts.

The information system provides a single sign-on capability for {{ insert: param, ia-2.10_prm_1 }}.

The information system implements multifactor authentication for remote access to privileged and non-privileged accounts such that one of the factors is provided by a device separate from the syste...

The information system accepts and electronically verifies Personal Identity Verification (PIV) credentials.

The information system implements {{ insert: param, ia-2.13_prm_1 }} under {{ insert: param, ia-2.13_prm_2 }}.

The information system uniquely identifies and authenticates {{ insert: param, ia-3_prm_1 }} before establishing a {{ insert: param, ia-3_prm_2 }} connection.

The information system authenticates {{ insert: param, ia-3.1_prm_1 }} before establishing {{ insert: param, ia-3.1_prm_2 }} connection using bidirectional authentication that is cryptographically ...

The organization: (a) Standardizes dynamic address allocation lease information and the lease duration assigned to devices in accordance with {{ insert: param, ia-3.3_prm_1 }}; and (b) Audits l...

The organization ensures that device identification and authentication based on attestation is handled by {{ insert: param, ia-3.4_prm_1 }}.

The organization manages information system identifiers by: a. Receiving authorization from {{ insert: param, ia-4_prm_1 }} to assign an individual, group, role, or device identifier; b. Select...

The organization prohibits the use of information system account identifiers that are the same as public identifiers for individual electronic mail accounts.

The organization requires that the registration process to receive an individual identifier includes supervisor authorization.

The organization requires multiple forms of certification of individual identification be presented to the registration authority.

The organization manages individual identifiers by uniquely identifying each individual as {{ insert: param, ia-4.4_prm_1 }}.

The information system dynamically manages identifiers.

The organization coordinates with {{ insert: param, ia-4.6_prm_1 }} for cross-organization management of identifiers.

The organization requires that the registration process to receive an individual identifier be conducted in person before a designated registration authority.

The organization manages information system authenticators by: a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving th...

The information system, for password-based authentication: (a) Enforces minimum password complexity of {{ insert: param, ia-5.1_prm_1 }}; (b) Enforces at least the following number of changed c...

The information system, for PKI-based authentication: (a) Validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate st...

The organization requires that the registration process to receive {{ insert: param, ia-5.3_prm_1 }} be conducted {{ insert: param, ia-5.3_prm_2 }} before {{ insert: param, ia-5.3_prm_3 }} with aut...

The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy {{ insert: param, ia-5.4_prm_1 }}.

The organization requires developers/installers of information system components to provide unique authenticators or change default authenticators prior to delivery/installation.

The organization protects authenticators commensurate with the security category of the information to which use of the authenticator permits access.

The organization ensures that unencrypted static authenticators are not embedded in applications or access scripts or stored on function keys.

The organization implements {{ insert: param, ia-5.8_prm_1 }} to manage the risk of compromise due to individuals having accounts on multiple information systems.

The organization coordinates with {{ insert: param, ia-5.9_prm_1 }} for cross-organization management of credentials.

The information system dynamically provisions identities.

The information system, for hardware token-based authentication, employs mechanisms that satisfy {{ insert: param, ia-5.11_prm_1 }}.

The information system, for biometric-based authentication, employs mechanisms that satisfy {{ insert: param, ia-5.12_prm_1 }}.

The information system prohibits the use of cached authenticators after {{ insert: param, ia-5.13_prm_1 }}.

The organization, for PKI-based authentication, employs a deliberate organization-wide methodology for managing the content of PKI trust stores installed across all platforms including networks, op...

The organization uses only FICAM-approved path discovery and validation products and services.

The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations,...

The information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users).

The information system accepts and electronically verifies Personal Identity Verification (PIV) credentials from other federal agencies.

The information system accepts only FICAM-approved third-party credentials.

The organization employs only FICAM-approved information system components in {{ insert: param, ia-8.3_prm_1 }} to accept third-party credentials.

The information system conforms to FICAM-issued profiles.

The information system accepts and electronically verifies Personal Identity Verification-I (PIV-I) credentials.

The organization identifies and authenticates {{ insert: param, ia-9_prm_1 }} using {{ insert: param, ia-9_prm_2 }}.

The organization ensures that service providers receive, validate, and transmit identification and authentication information.

The organization ensures that identification and authentication decisions are transmitted between {{ insert: param, ia-9.2_prm_1 }} consistent with organizational policies.

The organization requires that individuals accessing the information system employ {{ insert: param, ia-10_prm_1 }} under specific {{ insert: param, ia-10_prm_2 }}.

The organization requires users and devices to re-authenticate when {{ insert: param, ia-11_prm_1 }}.