Lexim011/Compliance huggingface dataset:
CCI-004021 (policy): Conduct backups of system documentation, including privacy-related documentation, per an organization-defined frequency that is consistent with recovery time and recovery point objectives.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (c)
CCI-004022 (policy): Protect the confidentiality of backup information.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (d)
CCI-004023 (policy): Protect integrity of backup information.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (d)
CCI-004024 (policy): Protect the availability of backup information.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (d)
CCI-000541 (policy): Defines the frequency with which to test backup information to verify media reliability and information integrity.
References: NIST: NIST SP 800-53 (v3): CP-9 (1) NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (1) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (1) NIST: NIST SP 800-53A (v1): CP-9 (1).1 (i)
CCI-000542 (policy): Test backup information per an organization-defined frequency to verify media reliability and information integrity.
References: NIST: NIST SP 800-53 (v3): CP-9 (1) NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (1) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (1) NIST: NIST SP 800-53A (v1): CP-9 (1).1 (ii)
CCI-000543 (policy): Use a sample of backup information in the restoration of selected system functions as part of contingency plan testing.
References: NIST: NIST SP 800-53 (v3): CP-9 (2) NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (2) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (2) NIST: NIST SP 800-53A (v1): CP-9 (2).1
CCI-002849 (policy): Defines critical system software and other security-related information, of which backup copies must be stored in a separate facility or in a fire-rated container.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (3) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (3)
CCI-002850 (policy): Store backup copies of organization-defined critical system software and other security-related information in a separate facility or in a fire-rated container that is not collocated with the operational system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (3) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (3)
CCI-000547 (policy): Defines the time-period and transfer rate of the system backup information to the alternate storage site consistent with the recovery time and recovery point objectives.
References: NIST: NIST SP 800-53 (v3): CP-9 (5) NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (5) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (5) NIST: NIST SP 800-53A (v1): CP-9 (5).1 (i)
CCI-000548 (policy): Transfer system backup information to the alternate storage site in accordance with the organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives.
References: NIST: NIST SP 800-53 (v3): CP-9 (5) NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (5) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (5) NIST: NIST SP 800-53A (v1): CP-9 (5).1 (ii)
CCI-000549 (policy): Maintain a redundant secondary system that is not collocated with the primary system.
References: NIST: NIST SP 800-53 (v3): CP-9 (6) NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (6) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (6) NIST: NIST SP 800-53A (v1): CP-9 (6).1 (i)
CCI-001609 (policy): Activate the redundant secondary system that is not collocated with the primary system without loss of information or disruption to operations.
References: NIST: NIST SP 800-53 (v3): CP-9 (6) NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (6) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (6) NIST: NIST SP 800-53A (v1): CP-9 (6).1 (ii)
CCI-002851 (policy): Defines the backup information that requires dual authorization for deletion or destruction.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (7) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (7)
CCI-002852 (policy): Enforce dual authorization for the deletion or destruction of organization-defined backup information.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (7) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (7)
CCI-004025 (policy): Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined backup information.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (8)
CCI-004026 (policy): Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined backup information.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (8)
CCI-004027 (policy): Defines the backup information which is protected by cryptographic mechanisms preventing unauthorized disclosure and modification.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (8)
CCI-004028 (policy): Provide for the recovery and reconstitution of the system to a known state within an organization-defined time-period consistent with recovery time and recovery point objectives after a disruption, compromise, or failure.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-10
CCI-004029 (policy): Defines the time-period consistent with recovery time and recovery point objectives for the recovery and reconstitution of the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-10
CCI-000553 (policy): Implement transaction recovery for systems that are transaction-based.
References: NIST: NIST SP 800-53 (v3): CP-10 (2) NIST: NIST SP 800-53 Revision 4 (v4): CP-10 (2) NIST: NIST SP 800-53 Revision 5 (v5): CP-10 (2) NIST: NIST SP 800-53A (v1): CP-10 (2).1
CCI-000556 (policy): Defines restoration time periods within which to restore system components from configuration-controlled and integrity-protected information representing a known, operational state for the components.
References: NIST: NIST SP 800-53 (v3): CP-10 (4) NIST: NIST SP 800-53 Revision 4 (v4): CP-10 (4) NIST: NIST SP 800-53 Revision 5 (v5): CP-10 (4) NIST: NIST SP 800-53A (v1): CP-10 (4).1
CCI-000557 (policy): Provide the capability to restore information system components within organization-defined restoration time periods from configuration-controlled and integrity-protected information representing a known, operational state for the components.
References: NIST: NIST SP 800-53 (v3): CP-10 (4) NIST: NIST SP 800-53 Revision 4 (v4): CP-10 (4) NIST: NIST SP 800-53 Revision 5 (v5): CP-10 (4) NIST: NIST SP 800-53A (v1): CP-10 (4).1
CCI-004030 (policy): Protect system components used for recovery and reconstitution.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-10 (6)
CCI-002853 (technical): Provide the capability to employ organization-defined alternative communications protocols in support of maintaining continuity of operations.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-11 NIST: NIST SP 800-53 Revision 5 (v5): CP-11
CCI-002854 (policy): Defines the alternative communications protocols the system must be capable of providing in support of maintaining continuity of operations.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-11 NIST: NIST SP 800-53 Revision 5 (v5): CP-11
CCI-002855 (technical): When organization-defined conditions are detected, enters a safe mode of operation with organization-defined restrictions of safe mode of operation.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-12 NIST: NIST SP 800-53 Revision 5 (v5): CP-12
CCI-002856 (policy): Defines the conditions that, when detected, the information system enters a safe mode of operation with organization-defined restrictions of safe mode of operation.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-12 NIST: NIST SP 800-53 Revision 5 (v5): CP-12
CCI-002857 (policy): Defines the restrictions of the safe mode of operation that the system will enter when organization-defined conditions are detected.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-12 NIST: NIST SP 800-53 Revision 5 (v5): CP-12
CCI-002858 (policy): Employ organization-defined alternative or supplemental security mechanisms for satisfying organization-defined security functions when the primary means of implementing the security function is unavailable or compromised.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-13 NIST: NIST SP 800-53 Revision 5 (v5): CP-13
CCI-002859 (policy): Defines the alternative or supplemental security mechanisms that will be employed for satisfying organization-defined security functions when the primary means of implementing the security function is unavailable or compromised.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-13 NIST: NIST SP 800-53 Revision 5 (v5): CP-13
CCI-002860 (policy): Defines the security functions that must be satisfied when the primary means of implementing the security function is unavailable or compromised.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-13 NIST: NIST SP 800-53 Revision 5 (v5): CP-13
CCI-000757 (policy): Disseminate an organization-level; mission/business process-level; and/or system-level identification and authentication policy to organization-defined personnel.
References: NIST: NIST SP 800-53 (v3): IA-1 a NIST: NIST SP 800-53 Revision 4 (v4): IA-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): IA-1 a 1 (a) NIST: NIST SP 800-53A (v1): IA-1.1 (iii)
CCI-004031 (policy): Defines the personnel or roles the organization-level; mission/business process-level; and/or system-level identification and authorization policy is disseminated to.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-1 a 1
CCI-004032 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level identification and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination, among organizational entities, and compliance.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-1 a 1 (a)
CCI-004033 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level identification and authorization policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-1 a 1 (b)
CCI-004034 (policy): Develop and document the procedures to facilitate the implementation of the identification and authorization policy and the associated identification and authentication controls.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-1 a 2
CCI-004035 (policy): Designate an organization-defined official to manage development and documentation of the identification and authentication policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-1 b
CCI-004036 (policy): Designate an organization-defined official to manage dissemination of the identification and authentication policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-1 b
CCI-004037 (policy): Designate an organization-defined official to manage development and documentation of the identification and authentication procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-1 b
CCI-004038 (policy): Designate an organization-defined official to manage dissemination of the identification and authentication procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-1 b
CCI-004039 (policy): Defines the official designated to managing the development, documentation, and dissemination of the identification and authentication policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-1 b
CCI-004040 (policy): Defines the official designated to managing the development, documentation, and dissemination of the identification and authentication procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-1 b
CCI-000758 (policy): Review and update the current identification and authentication policy in accordance with the organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): IA-1 a NIST: NIST SP 800-53 Revision 4 (v4): IA-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): IA-1 c 1 NIST: NIST SP 800-53A (v1): IA-1.2 (ii)
CCI-000759 (policy): Defines a frequency for reviewing and updating the identification and authentication policy.
References: NIST: NIST SP 800-53 (v3): IA-1 a NIST: NIST SP 800-53 Revision 4 (v4): IA-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): IA-1 c 1 NIST: NIST SP 800-53A (v1): IA-1.2 (i)
CCI-000762 (policy): Review and update the current identification and authentication procedures in accordance with the organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): IA-1 b NIST: NIST SP 800-53 Revision 4 (v4): IA-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): IA-1 c 2 NIST: NIST SP 800-53A (v1): IA-1.2 (iv)
CCI-000763 (policy): Defines a frequency for reviewing and updating the identification and authentication procedures.
References: NIST: NIST SP 800-53 (v3): IA-1 b NIST: NIST SP 800-53 Revision 4 (v4): IA-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): IA-1 c 2 NIST: NIST SP 800-53A (v1): IA-1.2 (iii)
CCI-004041 (policy): Review and update the current identification and authentication policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-1 c 1
CCI-004042 (policy): Defines the events following reviewing and updating the current identification and authentication policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-1 c 1
CCI-004043 (policy): Review and update the current identification and authentication procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-1 c 2
CCI-004044 (policy): Defines the events following reviewing and updating the current identification and authentication procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-1 c 2
CCI-000764 (technical): Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
References: NIST: NIST SP 800-53 (v3): IA-2 NIST: NIST SP 800-53 Revision 4 (v4): IA-2 NIST: NIST SP 800-53 Revision 5 (v5): IA-2 NIST: NIST SP 800-53A (v1): IA-2.1
CCI-000765 (technical): Implement multifactor authentication for network access to privileged accounts.
References: NIST: NIST SP 800-53 (v3): IA-2 (1) NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (1) NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (1) NIST: NIST SP 800-53A (v1): IA-2 (1).1
CCI-000766 (technical): Implement multifactor authentication for network access to non-privileged accounts.
References: NIST: NIST SP 800-53 (v3): IA-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (2) NIST: NIST SP 800-53A (v1): IA-2 (2).1
CCI-004045 (policy, technical): Require users to be individually authenticated before granting access to the shared accounts or resources.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (5)
CCI-004046 (technical): Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (6) (a)
CCI-004047 (technical): Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that the device meets organization-defined strength of mechanism requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (6) (b)
CCI-004048 (technical): Defines the strength of mechanism requirements for implementing multi-factor authentication.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (6) (b)
CCI-001941 (technical): Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (8) NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (8)
CCI-001943 (policy): Defines the system accounts for which single sign-on capability will be provided.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (10) NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (10)
CCI-001944 (policy): Defines the system services for which single sign-on capability will be provided.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (10) NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (10)
CCI-001945 (technical): Provide a single sign-on capability for organization-defined system accounts.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (10) NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (10)
CCI-001946 (technical): Provide a single sign-on capability for organization-defined system services.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (10) NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (10)
CCI-001953 (technical): Accepts Personal Identity Verification-compliant credentials.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (12) NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (12)
CCI-001954 (technical): Electronically verifies Personal Identity Verification-compliant credentials.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (12) NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (12)
CCI-001955 (policy): Defines the out-of-band authentication to be implemented under organization-defined conditions.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (13) NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (13)
CCI-001956 (policy): Defines the conditions for implementing organization-defined out-of-band authentication.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (13) NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (13)
CCI-001957 (technical): Implement organization-defined out-of-band authentication mechanisms under organization-defined conditions.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (13) NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (13)
CCI-000777 (policy): Defines devices and/or types of devices for which identification and authentication is required before establishing a connection.
References: NIST: NIST SP 800-53 (v3): IA-3 NIST: NIST SP 800-53 Revision 4 (v4): IA-3 NIST: NIST SP 800-53 Revision 5 (v5): IA-3 NIST: NIST SP 800-53A (v1): IA-3.1 (i)
CCI-000778 (technical): Uniquely identify organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.
References: NIST: NIST SP 800-53 (v3): IA-3 NIST: NIST SP 800-53 Revision 4 (v4): IA-3 NIST: NIST SP 800-53 Revision 5 (v5): IA-3 NIST: NIST SP 800-53A (v1): IA-3.1 (ii)
CCI-001958 (technical): Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-3 NIST: NIST SP 800-53 Revision 5 (v5): IA-3
CCI-001959 (policy): Defines the devices and/or types of devices the system is to authenticate before establishing a connection.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (1) NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (1)
CCI-001967 (technical): Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (1) NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (1)
CCI-001960 (policy): Defines the lease information to be assigned to devices.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (3) (a)
CCI-001961 (policy): Defines the lease duration to be assigned to devices.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (3) (a)
CCI-001962 (technical): Where addresses are allocated dynamically, standardize dynamic address allocation lease information assigned to devices in accordance with organization-defined lease information.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (3) (a)
CCI-001963 (technical): Where addresses are allocated dynamically, standardize dynamic address allocation lease duration assigned to devices in accordance with organization-defined lease duration.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (3) (a)
CCI-000783 (technical): Audit lease information when assigned to a device.
References: NIST: NIST SP 800-53 (v3): IA-3 (3) NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (3) (b) NIST: NIST SP 800-53A (v1): IA-3 (3).1 (ii)
CCI-001965 (policy): Defines the configuration management process that is to handle the device authentication procedures.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (4) NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (4)
CCI-001966 (policy): Handle device identification based on attestation is handled by the organization-defined configuration management process.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (4) NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (4)
CCI-001968 (policy): Defines the configuration management process that is to handle the device identification procedures.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (4) NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (4)
CCI-001969 (policy): Handle device authentication based on attestation is handled by the organization-defined configuration management process.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (4) NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (4)
CCI-001970 (policy): Defines the personnel or roles that authorize the assignment of individual, group, role, and device identifiers.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-4 a NIST: NIST SP 800-53 Revision 5 (v5): IA-4 a
CCI-001971 (policy): Manage system identifiers by receiving authorization from organization-defined personnel or roles to assign an individual, group, role, or device identifier.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-4 a NIST: NIST SP 800-53 Revision 5 (v5): IA-4 a
CCI-001972 (policy): Manage system identifiers by selecting an identifier that identifies an individual, group, role, or device.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-4 b NIST: NIST SP 800-53 Revision 5 (v5): IA-4 b
CCI-001973 (policy): Manage system identifiers by assigning the identifier to the intended individual, group, role, or device.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-4 c NIST: NIST SP 800-53 Revision 5 (v5): IA-4 c
CCI-001974 (policy): Defines the time period for which the reuse of identifiers is prohibited.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-4 d NIST: NIST SP 800-53 Revision 5 (v5): IA-4 d
CCI-001975 (policy): Manage system identifiers by preventing reuse of identifiers for an organization-defined time period.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-4 d NIST: NIST SP 800-53 Revision 5 (v5): IA-4 d
CCI-000796 (policy): Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts.
References: NIST: NIST SP 800-53 (v3): IA-4 (1) NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (1) NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (1) NIST: NIST SP 800-53A (v1): IA-4 (1).1
CCI-000800 (policy): Defines characteristics for identifying individual status.
References: NIST: NIST SP 800-53 (v3): IA-4 (4) NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (4) NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (4) NIST: NIST SP 800-53A (v1): IA-4 (4).1 (i)
CCI-000801 (policy): Manage individual identifiers by uniquely identifying each individual as organization-defined characteristics identifying individual status.
References: NIST: NIST SP 800-53 (v3): IA-4 (4) NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (4) NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (4) NIST: NIST SP 800-53A (v1): IA-4 (4).1 (ii)
CCI-001976 (technical): Manage individual identifiers dynamically in accordance with organization-defined identifier policy.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (5) NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (5)
CCI-004049 (technical): Defines the dynamic identifier policy for managing individual identifiers dynamically.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (5)
CCI-001977 (policy): Defines the external organizations with which it will coordinate for cross-management of identifiers.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (6) NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (6)
CCI-001978 (policy): Coordinate with organization-defined external organizations for cross-organization management of identifiers.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (6) NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (6)
CCI-004050 (policy): Generate pairwise pseudonymous identifiers.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (8)
CCI-004051 (policy, technical): Maintain the attributes for each uniquely identified individual, device, or service in organization-defined protected central storage.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (9)
CCI-004052 (policy, technical): Defines the protected central storage for maintaining the attributes for each uniquely individual, device or service.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (9)
CCI-001980 (policy): Manage system authenticators by verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 a NIST: NIST SP 800-53 Revision 5 (v5): IA-5 a
CCI-000176 (policy): Manage system authenticators by establishing initial authenticator content for authenticators issued by the organization.
References: NIST: NIST SP 800-53 (v3): IA-5 b NIST: NIST SP 800-53 Revision 4 (v4): IA-5 b NIST: NIST SP 800-53 Revision 5 (v5): IA-5 b NIST: NIST SP 800-53A (v1): IA-5.1 (ii)
CCI-001544 (policy): Manage system authenticators by ensuring that authenticators have sufficient strength of mechanism for their intended use.
References: NIST: NIST SP 800-53 (v3): IA-5 c NIST: NIST SP 800-53 Revision 4 (v4): IA-5 c NIST: NIST SP 800-53 Revision 5 (v5): IA-5 c NIST: NIST SP 800-53A (v1): IA-5.1 (ii)
CCI-001981 (policy): Manage system authenticators by establishing administrative procedures for initial authenticator distribution.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 d NIST: NIST SP 800-53 Revision 5 (v5): IA-5 d
CCI-001984 (policy): Manage system authenticators by establishing administrative procedures for revoking authenticators.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 d NIST: NIST SP 800-53 Revision 5 (v5): IA-5 d
CCI-001985 (policy): Manage system authenticators by implementing administrative procedures for initial authenticator distribution.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 d NIST: NIST SP 800-53 Revision 5 (v5): IA-5 d
CCI-001988 (policy): Manage system authenticators by implementing administrative procedures for revoking authenticators.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 d NIST: NIST SP 800-53 Revision 5 (v5): IA-5 d
CCI-004053 (policy): Manage system authenticators by establishing administrative procedures for lost/compromised or damaged authenticators.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 d
CCI-004054 (policy): Manage system authenticators by implementing administrative procedures for lost/compromised or damaged authenticators.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 d
CCI-004055 (policy): Manage system authenticators by changing default authenticators prior to first use.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 e
CCI-000182 (policy): Manage system authenticators by changing or refreshing authenticators in accordance with the organization-defined time period by authenticator type or when organization-defined events occur.
References: NIST: NIST SP 800-53 (v3): IA-5 g NIST: NIST SP 800-53 Revision 4 (v4): IA-5 g NIST: NIST SP 800-53 Revision 5 (v5): IA-5 f NIST: NIST SP 800-53A (v1): IA-5.1 (ii)
CCI-001610 (policy): Defines the time-period (by authenticator type) for changing/refreshing authenticators.
References: NIST: NIST SP 800-53 (v3): IA-5 g NIST: NIST SP 800-53 Revision 4 (v4): IA-5 g NIST: NIST SP 800-53 Revision 5 (v5): IA-5 f NIST: NIST SP 800-53A (v1): IA-5.1 (i)
CCI-004056 (policy): Defines the events for when to change or refresh authenticators.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 f
CCI-000183 (policy): Manage system authenticators by protecting authenticator content from unauthorized disclosure.
References: NIST: NIST SP 800-53 (v3): IA-5 h NIST: NIST SP 800-53 Revision 4 (v4): IA-5 h NIST: NIST SP 800-53 Revision 5 (v5): IA-5 g NIST: NIST SP 800-53A (v1): IA-5.1 (ii)
CCI-002042 (policy): Manage system authenticators by protecting authenticator content from unauthorized modification.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 h NIST: NIST SP 800-53 Revision 5 (v5): IA-5 g
CCI-000184 (policy): Manages system authenticators by requiring individuals to take, and having devices implement, specific security controls to protect authenticators.
References: NIST: NIST SP 800-53 (v3): IA-5 i NIST: NIST SP 800-53 Revision 4 (v4): IA-5 i NIST: NIST SP 800-53 Revision 5 (v5): IA-5 h NIST: NIST SP 800-53A (v1): IA-5.1 (ii)
CCI-001990 (policy): Manage system authenticators by changing authenticators for group or role accounts when membership to those accounts changes.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 j NIST: NIST SP 800-53 Revision 5 (v5): IA-5 i
CCI-004057 (policy): Defines the frequency for updating commonly used, expected, or compromised passwords, when they are suspected of being compromised directly or indirectly.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (a)
CCI-004058 (technical): For password-based authentication, maintain a list of commonly used, expected, or compromised passwords on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (a)
CCI-004059 (technical): For password-based authentication, update the list of passwords on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (a)
CCI-004060 (technical): For password-based authentication, update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (a)
CCI-004061 (technical): For password-based authentication, verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (b)
CCI-000197 (technical): For password-based authentication, transmit passwords only cryptographically-protected channels.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (c) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (c) NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (c) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v)
CCI-004062 (technical): For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (d)
CCI-004063 (technical): For password-based authentication, require immediate selection of a new password upon account recovery.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (e)
CCI-004064 (technical): For password-based authentication, allow user selection of long passwords and passphrases, including spaces and all printable characters.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (f)
CCI-004065 (technical): For password-based authentication, employ automated tools to assist the user in selecting strong password authenticators.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (g)
CCI-004066 (technical): For password-based authentication, enforce organization-defined composition and complexity rules.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (h)
CCI-004067 (policy): Defines the composition and complexity rules to be enforced.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (h)
CCI-000186 (technical): For public key-based authentication, enforce authorized access to the corresponding private key.
References: NIST: NIST SP 800-53 (v3): IA-5 (2) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (2) (b) NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (2) (a) (1) NIST: NIST SP 800-53A (v1): IA-5 (2).1
CCI-000187 (technical): For public key-based authentication, map the authenticated identity to the account of the individual or group.
References: NIST: NIST SP 800-53 (v3): IA-5 (2) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (2) (c) NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (2) (a) (2) NIST: NIST SP 800-53A (v1): IA-5 (2).1
CCI-000185 (technical): For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
References: NIST: NIST SP 800-53 (v3): IA-5 (2) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (2) (a) NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (2) (b) (1) NIST: NIST SP 800-53A (v1): IA-5 (2).1
CCI-004068 (technical): For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (2) (b) (2)
CCI-001998 (policy): Require developers and installers of system components to provide unique authenticators or change default authenticators prior to delivery and installation.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (5) NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (5)
CCI-000201 (policy): Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.
References: NIST: NIST SP 800-53 (v3): IA-5 (6) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (6) NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (6) NIST: NIST SP 800-53A (v1): IA-5 (6).1
CCI-004069 (policy): Ensure that the unencrypted static authenticators are not embedded in applications or other forms of static storage.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (7)
CCI-000204 (policy): Defines the security controls required to manage the risk of compromise due to individuals having accounts on multiple information systems.
References: NIST: NIST SP 800-53 (v3): IA-5 (8) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (8) NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (8) NIST: NIST SP 800-53A (v1): IA-5 (8).1 (i)
CCI-001621 (policy): Implement organization-defined security controls to manage the risk of compromise due to individuals having accounts on multiple systems.
References: NIST: NIST SP 800-53 (v3): IA-5 (8) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (8) NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (8) NIST: NIST SP 800-53A (v1): IA-5 (8).1 (ii)
CCI-004070 (policy): Use organization-defined external organizations to federate credentials.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (9)
CCI-004071 (policy): Defines the external organizations used to federate credentials.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (9)
CCI-002001 (technical): Bind identities and authenticators dynamically using organization-defined binding rules.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (10) NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (10)
CCI-004072 (technical): Defines the binding rules for binding identities and authenticators.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (10)
CCI-002004 (policy): Defines the biometric quality requirements to be employed by the mechanisms for biometric-based authentication.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (12) NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (12)
CCI-002005 (technical): For biometric-based authentication, employ mechanisms that satisfy organization-defined biometric quality requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (12) NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (12)
CCI-002006 (policy): Defines the time period after which the use of cached authenticators is prohibited.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (13) NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (13)
CCI-002007 (technical): Prohibit the use of cached authenticators after an organization-defined time period.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (13) NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (13)
CCI-002008 (policy): For PKI-based authentication, employs an organization-wide methodology for managing the content of PKI trust stores installed across all platforms including networks, operating systems, browsers, and applications.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (14) NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (14)
CCI-004073 (policy): Use only General Services Administration-approved and validated products and services for identity, credential, and access management.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (15)
CCI-004074 (policy): Require that the issuance of organization-defined types of and/or specific authenticators be conducted in person or by a trusted external party before the organization-defined registration authority with authorization by organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (16)
CCI-004075 (policy): Defines types of and/or specific authenticators to be conducted in person or by a trusted external party before the organization-defined registration authority.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (16)
CCI-004076 (policy): Defines the registration authority who conducts the issuance of organization-defined types of and/or specific authenticators.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (16)
CCI-004077 (policy): Defines the personnel or roles who authorize the issuance of organization-defined types of and/or specific authenticators.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (16)
CCI-004078 (technical): Employ presentation attack detection mechanisms for biometric-based authentication.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (17)
CCI-004079 (technical): Employ organization-defined password managers to generate and manage passwords.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (18) (a)
CCI-004080 (technical): Defines the password managers employed to generate and manage passwords.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (18) (a)
CCI-004081 (technical): Protect the passwords using organization-defined controls.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (18) (b)
CCI-004082 (technical): Defines the controls for protecting the passwords.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (18) (b)
CCI-000206 (technical): Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.
References: NIST: NIST SP 800-53 (v3): IA-6 NIST: NIST SP 800-53 Revision 4 (v4): IA-6 NIST: NIST SP 800-53 Revision 5 (v5): IA-6 NIST: NIST SP 800-53A (v1): IA-6.1
CCI-000803 (technical): Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
References: NIST: NIST SP 800-53 (v3): IA-7 NIST: NIST SP 800-53 Revision 4 (v4): IA-7 NIST: NIST SP 800-53 Revision 5 (v5): IA-7 NIST: NIST SP 800-53A (v1): IA-7.1
CCI-000804 (technical): Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
References: NIST: NIST SP 800-53 (v3): IA-8 NIST: NIST SP 800-53 Revision 4 (v4): IA-8 NIST: NIST SP 800-53 Revision 5 (v5): IA-8 NIST: NIST SP 800-53A (v1): IA-8.1
CCI-002009 (technical): Accept Personal Identity Verification-compliant credentials from other federal agencies.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-8 (1) NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (1)
CCI-002010 (technical): Electronically verify Personal Identity Verification-compliant credentials from other federal agencies.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-8 (1) NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (1)
CCI-004083 (technical): Accept only external credentials that are NIST compliant.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (2) (a)
CCI-004084 (technical): Document and maintain a list of accepted external authenticators.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (2) (b)
CCI-004085 (technical): Conform to organization-defined identity management profiles for identity management.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (4)
CCI-004086 (technical): Defines the identity management profiles for conforming to the profiles for identity management.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (4)
CCI-002015 (technical): Accept federated or PKI credentials that meet organization-defined policy.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-8 (5) NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (5)
CCI-002016 (technical): Verify federated PKI credentials that meet organization-defined policy.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-8 (5) NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (5)
CCI-004087 (technical): Defines the policy for accepting and verifying federated or PKI credentials.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (5)
CCI-004088 (policy): Implement organization-defined measures to disassociate user attributes or identifier assertion relationships among individuals.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (6)
CCI-004089 (policy): Implement organization-defined measures to disassociate user attributes or identifier assertion relationships among credential service providers.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (6)
CCI-004090 (policy): Implement organization-defined measures to disassociate user attributes or identifier assertion relationships among relying parties.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (6)
CCI-004091 (policy): Defines the measures to be implemented to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (6)
CCI-002018 (policy): Defines the system services and applications requiring authentication.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-9 NIST: NIST SP 800-53 Revision 5 (v5): IA-9
CCI-002021 (policy): Uniquely identify organization-defined system services and applications before establishing communications with devices, users, or other services or applications.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-9 NIST: NIST SP 800-53 Revision 5 (v5): IA-9
CCI-002022 (policy): Uniquely authenticate organization-defined system services and applications before establishing communications with devices, users, or other services or applications.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-9 NIST: NIST SP 800-53 Revision 5 (v5): IA-9
CCI-002033 (policy): Defines the specific circumstances or situations when individuals accessing the system employ organization-defined supplemental authentication techniques or mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-10 NIST: NIST SP 800-53 Revision 5 (v5): IA-10
CCI-002034 (policy): Defines the supplemental authentication techniques or mechanisms to be employed in specific organization-defined circumstances or situations by individuals accessing the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-10 NIST: NIST SP 800-53 Revision 5 (v5): IA-10
CCI-002035 (policy): Require individuals accessing the system employ organization-defined supplemental authentication techniques or mechanisms under specific organization-defined circumstances or situations.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-10 NIST: NIST SP 800-53 Revision 5 (v5): IA-10
CCI-002036 (policy): Defines the circumstances or situations under which users will be required to reauthenticate.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-11 NIST: NIST SP 800-53 Revision 5 (v5): IA-11
CCI-004092 (policy): Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 a
CCI-004093 (policy): Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 a
CCI-004094 (policy): Resolve user identities to a unique individual.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 b
CCI-004095 (policy): Collect identity evidence.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 c
CCI-004096 (policy): Validate identity evidence.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 c
CCI-004097 (policy): Verify identity evidence.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 c
CCI-004098 (policy): Require that the registration process to receive an account for logical access includes supervisor or sponsor authorization.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (1)
CCI-004099 (policy): Require evidence of individual identification be presented to the registration authority.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (2)
CCI-004100 (policy): Require that the presented identity evidence be validated through organizational defined methods of validation.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (3)
CCI-004101 (policy): Require that the presented identity evidence be verified through organizational defined methods of verification.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (3)
CCI-004102 (policy): Defines the methods of validation required for presenting identity evidence.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (3)
CCI-004103 (policy): Defines the methods of verification required for presenting identity evidence.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (3)
CCI-004104 (policy): Require that the validation of identity evidence be conducted in person before a designated registration authority.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (4)
CCI-004105 (policy): Require that the verification of identity evidence be conducted in person before a designated registration authority.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (4)
CCI-004106 (policy): Require that a registration code or notice of proofing be delivered through an out-of-band channel to verify the users address (physical or digital) of record.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (5)
CCI-004107 (policy): Accept externally-proofed identities at an organization-defined identity assurance level.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (6)
CCI-004108 (policy): Defines the identity assurance level by accepting externally-proofed identities.
References: NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (6)
CCI-000805 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): IR-1 a NIST: NIST SP 800-53 Revision 4 (v4): IR-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): IR-1 a 1 (a) NIST: NIST SP 800-53A (v1): IR-1.1 (i) (ii)
CCI-000806 (policy): Disseminate an organization-level; mission/business process-level; and/or system-level incident response policy to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): IR-1 a NIST: NIST SP 800-53 Revision 4 (v4): IR-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): IR-1 a 1 (a) NIST: NIST SP 800-53A (v1): IR-1.1 (iii)
CCI-000809 (policy): Develop and document procedures to facilitate the implementation of incident response policy and associated incident response controls.
References: NIST: NIST SP 800-53 (v3): IR-1 b NIST: NIST SP 800-53 Revision 4 (v4): IR-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): IR-1 a 2 NIST: NIST SP 800-53A (v1): IR-1.1 (iv) (v)
CCI-000810 (policy): Disseminate the incident response procedures to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): IR-1 b NIST: NIST SP 800-53 Revision 4 (v4): IR-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): IR-1 a 2 NIST: NIST SP 800-53A (v1): IR-1.1 (vi)