ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(5) > Discussion

IA-5(5) Change Authenticators Prior to Delivery - Discussion
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Changing authenticators prior to the delivery and installation of system components extends the requirement for organizations to change default authenticators upon system installation by requiring developers and/or installers to provide unique authenticators or change default authenticators for system components prior to delivery and/or installation. However, it typically does not apply to developers of commercial off-the-shelf information technology products. Requirements for unique authenticators can be included in acquisition documents prepared by organizations when procuring systems or system components.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(5)

IA-5(5) Authenticator Management | Change Authenticators Prior to Delivery
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Require developers and installers of system components to provide unique authenticators or change default authenticators prior to delivery and installation.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(6) > Discussion

IA-5(6) Protection of Authenticators - Discussion
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

For systems that contain multiple security categories of information without reliable physical or logical separation between categories, authenticators used to grant access to the systems are protected commensurate with the highest security category of information on the systems. Security categories of information are determined as part of the security categorization process.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(6)

IA-5(6) Authenticator Management | Protection of Authenticators
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(7) > Discussion

IA-5(7) No Embedded Unencrypted Static Authenticators - Discussion
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

In addition to applications, other forms of static storage include access scripts and function keys. Organizations exercise caution when determining whether embedded or stored authenticators are in encrypted or unencrypted form. If authenticators are used in the manner stored, then those representations are considered unencrypted authenticators.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(7)

IA-5(7) Authenticator Management | No Embedded Unencrypted Static Authenticators
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(8) > Discussion

IA-5(8) Multiple System Accounts - Discussion
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

When individuals have accounts on multiple systems and use the same authenticators such as passwords, there is the risk that a compromise of one account may lead to the compromise of other accounts. Alternative approaches include having different authenticators (passwords) on all systems, employing a single sign-on or federation mechanism, or using some form of one-time passwords on all systems. Organizations can also use rules of behavior (see [PL-4](#pl-4) ) and access agreements (see [PS-6](#ps-6) ) to mitigate the risk of multiple system accounts.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(8)

IA-5(8) Authenticator Management | Multiple System Accounts
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Implement [Assignment: organization-defined security controls] to manage the risk of compromise due to individuals having accounts on multiple systems.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(9) > Discussion

IA-5(9) Federated Credential Management - Discussion
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Federation provides organizations with the capability to authenticate individuals and devices when conducting cross-organization activities involving the processing, storage, or transmission of information. Using a specific list of approved external organizations for authentication helps to ensure that those organizations are vetted and trusted.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(9)

IA-5(9) Authenticator Management | Federated Credential Management
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Use the following external organizations to federate credentials: [Assignment: organization-defined external organizations].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(10) > Discussion

IA-5(10) Dynamic Credential Binding - Discussion
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Authentication requires some form of binding between an identity and the authenticator that is used to confirm the identity. In conventional approaches, binding is established by pre-provisioning both the identity and the authenticator to the system. For example, the binding between a username (i.e., identity) and a password (i.e., authenticator) is accomplished by provisioning the identity and authenticator as a pair in the system. New authentication techniques allow the binding between the identity and the authenticator to be implemented external to a system. For example, with smartcard credentials, the identity and authenticator are bound together on the smartcard. Using these credentials, systems can authenticate identities that have not been pre-provisioned, dynamically provisioning the identity after authentication. In these situations, organizations can anticipate the dynamic provisioning of identities. Pre-established trust relationships and mechanisms with appropriate authorities to validate identities and related credentials are essential.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(10)

IA-5(10) Authenticator Management | Dynamic Credential Binding
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Bind identities and authenticators dynamically using the following rules: [Assignment: organization-defined binding rules].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(12) > Discussion

IA-5(12) Biometric Authentication Performance - Discussion
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Unlike password-based authentication, which provides exact matches of user-input passwords to stored passwords, biometric authentication does not provide exact matches. Depending on the type of biometric and the type of collection mechanism, there is likely to be some divergence from the presented biometric and the stored biometric that serves as the basis for comparison. Matching performance is the rate at which a biometric algorithm correctly results in a match for a genuine user and rejects other users. Biometric performance requirements include the match rate, which reflects the accuracy of the biometric matching algorithm used by a system.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(12)

IA-5(12) Authenticator Management | Biometric Authentication Performance
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

For biometric-based authentication, employ mechanisms that satisfy the following biometric quality requirements [Assignment: organization-defined biometric quality requirements].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(13) > Discussion

IA-5(13) Expiration of Cached Authenticators - Discussion
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Cached authenticators are used to authenticate to the local machine when the network is not available. If cached authentication information is out of date, the validity of the authentication information may be questionable.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(13)

IA-5(13) Authenticator Management | Expiration of Cached Authenticators
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Prohibit the use of cached authenticators after [Assignment: organization-defined time period].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(14) > Discussion

IA-5(14) Managing Content of PKI Trust Stores - Discussion
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

An organization-wide methodology for managing the content of PKI trust stores helps improve the accuracy and currency of PKI-based authentication credentials across the organization.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(14)

IA-5(14) Authenticator Management | Managing Content of PKI Trust Stores
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

For PKI-based authentication, employ an organization-wide methodology for managing the content of PKI trust stores installed across all platforms, including networks, operating systems, browsers, and applications.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(15) > Discussion

IA-5(15) GSA-approved Products and Services - Discussion
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

General Services Administration (GSA)-approved products and services are products and services that have been approved through the GSA conformance program, where applicable, and posted to the GSA Approved Products List. GSA provides guidance for teams to design and build functional and secure systems that comply with Federal Identity, Credential, and Access Management (FICAM) policies, technologies, and implementation patterns.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(15)

IA-5(15) Authenticator Management | GSA-approved Products and Services
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Use only General Services Administration-approved products and services for identity, credential, and access management.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(16) > Discussion

IA-5(16) In-person or Trusted External Party Authenticator Issuance - Discussion
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Issuing authenticators in person or by a trusted external party enhances and reinforces the trustworthiness of the identity proofing process.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(16)

IA-5(16) Authenticator Management | In-person or Trusted External Party Authenticator Issuance
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Require that the issuance of [Assignment: organization-defined types of and/or specific authenticators] be conducted [Selection: in person; by a trusted external party] before [Assignment: organization-defined registration authority] with authorization by [Assignment: organization-defined personnel or roles].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(17) > Discussion

IA-5(17) Presentation Attack Detection for Biometric Authenticators - Discussion
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Biometric characteristics do not constitute secrets. Such characteristics can be obtained by online web accesses, taking a picture of someone with a camera phone to obtain facial images with or without their knowledge, lifting from objects that someone has touched (e.g., a latent fingerprint), or capturing a high-resolution image (e.g., an iris pattern). Presentation attack detection technologies including liveness detection, can mitigate the risk of these types of attacks by making it difficult to produce artifacts intended to defeat the biometric sensor.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(17)

IA-5(17) Authenticator Management | Presentation Attack Detection for Biometric Authenticators
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Employ presentation attack detection mechanisms for biometric-based authentication.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(18) > Discussion

IA-5(18) Password Managers - Discussion
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

For systems where static passwords are employed, it is often a challenge to ensure that the passwords are suitably complex and that the same passwords are not employed on multiple systems. A password manager is a solution to this problem as it automatically generates and stores strong and different passwords for various accounts. A potential risk of using password managers is that adversaries can target the collection of passwords generated by the password manager. Therefore, the collection of passwords requires protection including encrypting the passwords (see [IA-5(1)(d)](#ia-5.1_smt.d) ) and storing the collection offline in a token.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(18)

IA-5(18) Authenticator Management | Password Managers
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

(a) Employ [Assignment: organization-defined password managers] to generate and manage passwords; and
(b) Protect the passwords using [Assignment: organization-defined controls].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-6

IA-6 Authentication Feedback
Family: Identification and Authentication (IA)

Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-6 > Discussion

IA-6 Authentication Feedback - Discussion
Family: Identification and Authentication (IA)

Authentication feedback from systems does not provide information that would allow unauthorized individuals to compromise authentication mechanisms. For some types of systems, such as desktops or notebooks with relatively large monitors, the threat (referred to as shoulder surfing) may be significant. For other types of systems, such as mobile devices with small displays, the threat may be less significant and is balanced against the increased likelihood of typographic input errors due to small keyboards. Thus, the means for obscuring authentication feedback is selected accordingly. Obscuring authentication feedback includes displaying asterisks when users type passwords into input devices or displaying feedback for a very limited time before obscuring it.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-7

IA-7 Cryptographic Module Authentication
Family: Identification and Authentication (IA)

Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-7 > Discussion

IA-7 Cryptographic Module Authentication - Discussion
Family: Identification and Authentication (IA)

Authentication mechanisms may be required within a cryptographic module to authenticate an operator accessing the module and to verify that the operator is authorized to assume the requested role and perform services within that role.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-8

IA-8 Identification and Authentication (Non-organizational Users)
Family: Identification and Authentication (IA)

Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-8 > Discussion

IA-8 Identification and Authentication (Non-organizational Users) - Discussion
Family: Identification and Authentication (IA)

Non-organizational users include system users other than organizational users explicitly covered by [IA-2](#ia-2) . Non-organizational users are uniquely identified and authenticated for accesses other than those explicitly identified and documented in [AC-14](#ac-14) . Identification and authentication of non-organizational users accessing federal systems may be required to protect federal, proprietary, or privacy-related information (with exceptions noted for national security systems). Organizations consider many factors-including security, privacy, scalability, and practicality-when balancing the need to ensure ease of use for access to federal information and systems with the need to protect and adequately mitigate risk.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-8 > IA-8(1) > Discussion

IA-8(1) Acceptance of PIV Credentials from Other Agencies - Discussion
Family: Identification and Authentication (IA) > IA-8 Identification and Authentication (Non-organizational Users)

Acceptance of Personal Identity Verification (PIV) credentials from other federal agencies applies to both logical and physical access control systems. PIV credentials are those credentials issued by federal agencies that conform to FIPS Publication 201 and supporting guidelines. The adequacy and reliability of PIV card issuers are addressed and authorized using [SP 800-79-2](#10963761-58fc-4b20-b3d6-b44a54daba03).
Security and Privacy Controls for Information Systems and Organizations
IA > IA-8 > IA-8(1)

IA-8(1) Identification and Authentication (Non-organizational Users) | Acceptance of PIV Credentials from Other Agencies
Family: Identification and Authentication (IA) > IA-8 Identification and Authentication (Non-organizational Users)

Accept and electronically verify Personal Identity Verification-compliant credentials from other federal agencies.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-8 > IA-8(2) > Discussion

IA-8(2) Acceptance of External Authenticators - Discussion
Family: Identification and Authentication (IA) > IA-8 Identification and Authentication (Non-organizational Users)

Acceptance of only NIST-compliant external authenticators applies to organizational systems that are accessible to the public (e.g., public-facing websites). External authenticators are issued by nonfederal government entities and are compliant with [SP 800-63B](#e59c5a7c-8b1f-49ca-8de0-6ee0882180ce) . Approved external authenticators meet or exceed the minimum Federal Government-wide technical, security, privacy, and organizational maturity requirements. Meeting or exceeding Federal requirements allows Federal Government relying parties to trust external authenticators in connection with an authentication transaction at a specified authenticator assurance level.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-8 > IA-8(2)

IA-8(2) Identification and Authentication (Non-organizational Users) | Acceptance of External Authenticators
Family: Identification and Authentication (IA) > IA-8 Identification and Authentication (Non-organizational Users)

(a) Accept only external authenticators that are NIST-compliant; and
(b) Document and maintain a list of accepted external authenticators.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-8 > IA-8(4) > Discussion

IA-8(4) Use of Defined Profiles - Discussion
Family: Identification and Authentication (IA) > IA-8 Identification and Authentication (Non-organizational Users)

Organizations define profiles for identity management based on open identity management standards. To ensure that open identity management standards are viable, robust, reliable, sustainable, and interoperable as documented, the Federal Government assesses and scopes the standards and technology implementations against applicable laws, executive orders, directives, policies, regulations, standards, and guidelines.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-8 > IA-8(4)

IA-8(4) Identification and Authentication (Non-organizational Users) | Use of Defined Profiles
Family: Identification and Authentication (IA) > IA-8 Identification and Authentication (Non-organizational Users)

Conform to the following profiles for identity management [Assignment: organization-defined identity management profiles].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-8 > IA-8(5) > Discussion

IA-8(5) Acceptance of PIV-I Credentials - Discussion
Family: Identification and Authentication (IA) > IA-8 Identification and Authentication (Non-organizational Users)

Acceptance of PIV-I credentials can be implemented by PIV, PIV-I, and other commercial or external identity providers. The acceptance and verification of PIV-I-compliant credentials apply to both logical and physical access control systems. The acceptance and verification of PIV-I credentials address nonfederal issuers of identity cards that desire to interoperate with United States Government PIV systems and that can be trusted by Federal Government-relying parties. The X.509 certificate policy for the Federal Bridge Certification Authority (FBCA) addresses PIV-I requirements. The PIV-I card is commensurate with the PIV credentials as defined in cited references. PIV-I credentials are the credentials issued by a PIV-I provider whose PIV-I certificate policy maps to the Federal Bridge PIV-I Certificate Policy. A PIV-I provider is cross-certified with the FBCA (directly or through another PKI bridge) with policies that have been mapped and approved as meeting the requirements of the PIV-I policies defined in the FBCA certificate policy.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-8 > IA-8(5)

IA-8(5) Identification and Authentication (Non-organizational Users) | Acceptance of PIV-I Credentials
Family: Identification and Authentication (IA) > IA-8 Identification and Authentication (Non-organizational Users)

Accept and verify federated or PKI credentials that meet [Assignment: organization-defined policy].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-8 > IA-8(6) > Discussion

IA-8(6) Disassociability - Discussion
Family: Identification and Authentication (IA) > IA-8 Identification and Authentication (Non-organizational Users)

Federated identity solutions can create increased privacy risks due to the tracking and profiling of individuals. Using identifier mapping tables or cryptographic techniques to blind credential service providers and relying parties from each other or to make identity attributes less visible to transmitting parties can reduce these privacy risks.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-8 > IA-8(6)

IA-8(6) Identification and Authentication (Non-organizational Users) | Disassociability
Family: Identification and Authentication (IA) > IA-8 Identification and Authentication (Non-organizational Users)

Implement the following measures to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties: [Assignment: organization-defined measures].