Identification and Authentication¶

Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Implement multi-factor authentication for access to privileged accounts.

Implement multi-factor authentication for access to non-privileged accounts.

Implement multi-factor authentication for [Selection: one or more of: local; network; remote] access to [Selection: one or more of: privileged accounts; non-privileged accounts] such that:

• (a) One of the factors is provided by a device separate from the system gaining access; and
• (b) The device meets [Assignment: organization-defined strength of mechanism requirements].

Implement replay-resistant authentication mechanisms for access to [Selection: one or more of: privileged accounts; non-privileged accounts].

Manage individual identifiers by uniquely identifying each individual as [Assignment: organization-defined characteristics].

Manage system authenticators by:

• a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator;
• b. Establishing initial authenticator content for any authenticators issued by the organization;
• c. Ensuring that authenticators have sufficient strength of mechanism for their intended use;
• d. Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators;
• e. Changing default authenticators prior to first use;
• f. Changing or refreshing authenticators [Assignment: organization-defined time period by authenticator type] or when [Assignment: organization-defined events] occur;
• g. Protecting authenticator content from unauthorized disclosure and modification;
• h. Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and
• i. Changing authenticators for group or role accounts when membership to those accounts changes.