a. Develop, document, and disseminate to {{ insert: param, ia-1_prm_1 }}: 1. {{ insert: param, ia-01_odp.03 }} identification and authentication policy that: (a) Addresses purpose, scop...

Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Implement multi-factor authentication for access to privileged accounts.

Implement multi-factor authentication for access to non-privileged accounts.

When shared accounts or authenticators are employed, require users to be individually authenticated before granting access to the shared accounts or resources.

Implement multi-factor authentication for {{ insert: param, ia-02.06_odp.01 }} access to {{ insert: param, ia-02.06_odp.02 }} such that: (a) One of the factors is provided by a device separate fr...

Implement replay-resistant authentication mechanisms for access to {{ insert: param, ia-02.08_odp }}.

Provide a single sign-on capability for {{ insert: param, ia-02.10_odp }}.

Accept and electronically verify Personal Identity Verification-compliant credentials.

Implement the following out-of-band authentication mechanisms under {{ insert: param, ia-02.13_odp.02 }}: {{ insert: param, ia-02.13_odp.01 }}.

Uniquely identify and authenticate {{ insert: param, ia-03_odp.01 }} before establishing a {{ insert: param, ia-03_odp.02 }} connection.

Authenticate {{ insert: param, ia-03.01_odp.01 }} before establishing {{ insert: param, ia-03.01_odp.02 }} connection using bidirectional authentication that is cryptographically based.

(a) Where addresses are allocated dynamically, standardize dynamic address allocation lease information and the lease duration assigned to devices in accordance with {{ insert: param, ia-3.3_prm_...

Handle device identification and authentication based on attestation by {{ insert: param, ia-03.04_odp }}.

Manage system identifiers by: a. Receiving authorization from {{ insert: param, ia-04_odp.01 }} to assign an individual, group, role, service, or device identifier; b. Selecting an identifier t...

Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts.

Manage individual identifiers by uniquely identifying each individual as {{ insert: param, ia-04.04_odp }}.

Manage individual identifiers dynamically in accordance with {{ insert: param, ia-04.05_odp }}.

Coordinate with the following external organizations for cross-organization management of identifiers: {{ insert: param, ia-04.06_odp }}.

Generate pairwise pseudonymous identifiers.

Maintain the attributes for each uniquely identified individual, device, or service in {{ insert: param, ia-04.09_odp }}.

Manage system authenticators by: a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator; b....

For password-based authentication: (a) Maintain a list of commonly-used, expected, or compromised passwords and update the list {{ insert: param, ia-05.01_odp.01 }} and when organizational passwo...

(a) For public key-based authentication: (1) Enforce authorized access to the corresponding private key; and (2) Map the authenticated identity to the account of the individual or group; ...

Require developers and installers of system components to provide unique authenticators or change default authenticators prior to delivery and installation.

Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.

Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage.

Implement {{ insert: param, ia-05.08_odp }} to manage the risk of compromise due to individuals having accounts on multiple systems.

Use the following external organizations to federate credentials: {{ insert: param, ia-05.09_odp }}.

Bind identities and authenticators dynamically using the following rules: {{ insert: param, ia-05.10_odp }}.

For biometric-based authentication, employ mechanisms that satisfy the following biometric quality requirements {{ insert: param, ia-05.12_odp }}.

Prohibit the use of cached authenticators after {{ insert: param, ia-05.13_odp }}.

For PKI-based authentication, employ an organization-wide methodology for managing the content of PKI trust stores installed across all platforms, including networks, operating systems, browsers, a...

Use only General Services Administration-approved products and services for identity, credential, and access management.

Require that the issuance of {{ insert: param, ia-05.16_odp.01 }} be conducted {{ insert: param, ia-05.16_odp.02 }} before {{ insert: param, ia-05.16_odp.03 }} with authorization by {{ insert: para...

Employ presentation attack detection mechanisms for biometric-based authentication.

(a) Employ {{ insert: param, ia-05.18_odp.01 }} to generate and manage passwords; and (b) Protect the passwords using {{ insert: param, ia-05.18_odp.02 }}.

Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.

Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for s...

Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.

Accept and electronically verify Personal Identity Verification-compliant credentials from other federal agencies.

(a) Accept only external authenticators that are NIST-compliant; and (b) Document and maintain a list of accepted external authenticators.

Conform to the following profiles for identity management {{ insert: param, ia-08.04_odp }}.

Accept and verify federated or PKI credentials that meet {{ insert: param, ia-08.05_odp }}.

Implement the following measures to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties: {{ insert: param, ia-08....

Uniquely identify and authenticate {{ insert: param, ia-09_odp }} before establishing communications with devices, users, or other services or applications.

Require individuals accessing the system to employ {{ insert: param, ia-10_odp.01 }} under specific {{ insert: param, ia-10_odp.02 }}.

Require users to re-authenticate when {{ insert: param, ia-11_odp }}.

a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines; b. Re...

Require that the registration process to receive an account for logical access includes supervisor or sponsor authorization.

Require evidence of individual identification be presented to the registration authority.

Require that the presented identity evidence be validated and verified through {{ insert: param, ia-12.03_odp }}.

Require that the validation and verification of identity evidence be conducted in person before a designated registration authority.

Require that a {{ insert: param, ia-12.05_odp }} be delivered through an out-of-band channel to verify the users address (physical or digital) of record.

Accept externally-proofed identities at {{ insert: param, ia-12.06_odp }}.

Employ identity providers and authorization servers to manage user, device, and non-person entity (NPE) identities, attributes, and access rights supporting authentication and authorization decisio...

Cryptographic keys that protect access tokens are generated, managed, and protected from disclosure and misuse.

The source and integrity of identity assertions and access tokens are verified before granting access to system and information resources.

In accordance with {{ insert: param, ia-13_odp.01 }}, assertions and access tokens are: (a) generated; (b) issued; (c) refreshed; (d) revoked; (e) time-restricted; and (f) audience-rest...