ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > IA-2(10)

IA-2(10) Identification and Authentication (Organizational Users) | Single Sign-on
Family: Identification and Authentication (IA) > IA-2 Identification and Authentication (Organizational Users)

Provide a single sign-on capability for [Assignment: organization-defined system accounts and services].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > IA-2(12) > Discussion

IA-2(12) Acceptance of PIV Credentials - Discussion
Family: Identification and Authentication (IA) > IA-2 Identification and Authentication (Organizational Users)

Acceptance of Personal Identity Verification (PIV)-compliant credentials applies to organizations implementing logical access control and physical access control systems. PIV-compliant credentials are those credentials issued by federal agencies that conform to FIPS Publication 201 and supporting guidance documents. The adequacy and reliability of PIV card issuers are authorized using [SP 800-79-2](#10963761-58fc-4b20-b3d6-b44a54daba03) . Acceptance of PIV-compliant credentials includes derived PIV credentials, the use of which is addressed in [SP 800-166](#e8552d48-cf41-40aa-8b06-f45f7fb4706c) . The DOD Common Access Card (CAC) is an example of a PIV credential.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > IA-2(12)

IA-2(12) Identification and Authentication (Organizational Users) | Acceptance of PIV Credentials
Family: Identification and Authentication (IA) > IA-2 Identification and Authentication (Organizational Users)

Accept and electronically verify Personal Identity Verification-compliant credentials.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > IA-2(13) > Discussion

IA-2(13) Out-of-band Authentication - Discussion
Family: Identification and Authentication (IA) > IA-2 Identification and Authentication (Organizational Users)

Out-of-band authentication refers to the use of two separate communication paths to identify and authenticate users or devices to an information system. The first path (i.e., the in-band path) is used to identify and authenticate users or devices and is generally the path through which information flows. The second path (i.e., the out-of-band path) is used to independently verify the authentication and/or requested action. For example, a user authenticates via a notebook computer to a remote server to which the user desires access and requests some action of the server via that communication path. Subsequently, the server contacts the user via the user's cell phone to verify that the requested action originated from the user. The user may confirm the intended action to an individual on the telephone or provide an authentication code via the telephone. Out-of-band authentication can be used to mitigate actual or suspected "man-in the-middle" attacks. The conditions or criteria for activation include suspicious activities, new threat indicators, elevated threat levels, or the impact or classification level of information in requested transactions.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > IA-2(13)

IA-2(13) Identification and Authentication (Organizational Users) | Out-of-band Authentication
Family: Identification and Authentication (IA) > IA-2 Identification and Authentication (Organizational Users)

Implement the following out-of-band authentication mechanisms under [Assignment: organization-defined conditions]: [Assignment: organization-defined out-of-band authentication].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-3

IA-3 Device Identification and Authentication
Family: Identification and Authentication (IA)

Uniquely identify and authenticate [Assignment: organization-defined devices and/or types of devices] before establishing a [Selection; one or more: local; remote; network] connection.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-3 > Discussion

IA-3 Device Identification and Authentication - Discussion
Family: Identification and Authentication (IA)

Devices that require unique device-to-device identification and authentication are defined by type, device, or a combination of type and device. Organization-defined device types include devices that are not owned by the organization. Systems use shared known information (e.g., Media Access Control [MAC], Transmission Control Protocol/Internet Protocol [TCP/IP] addresses) for device identification or organizational authentication solutions (e.g., Institute of Electrical and Electronics Engineers (IEEE) 802.1x and Extensible Authentication Protocol [EAP], RADIUS server with EAP-Transport Layer Security [TLS] authentication, Kerberos) to identify and authenticate devices on local and wide area networks. Organizations determine the required strength of authentication mechanisms based on the security categories of systems and mission or business requirements. Because of the challenges of implementing device authentication on a large scale, organizations can restrict the application of the control to a limited number/type of devices based on mission or business needs.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-3 > IA-3(1) > Discussion

IA-3(1) Cryptographic Bidirectional Authentication - Discussion
Family: Identification and Authentication (IA) > IA-3 Device Identification and Authentication

A local connection is a connection with a device that communicates without the use of a network. A network connection is a connection with a device that communicates through a network. A remote connection is a connection with a device that communicates through an external network. Bidirectional authentication provides stronger protection to validate the identity of other devices for connections that are of greater risk.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-3 > IA-3(1)

IA-3(1) Device Identification and Authentication | Cryptographic Bidirectional Authentication
Family: Identification and Authentication (IA) > IA-3 Device Identification and Authentication

Authenticate [Assignment: organization-defined devices and/or types of devices] before establishing [Selection; one or more: local; remote; network] connection using bidirectional authentication that is cryptographically based.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-3 > IA-3(3) > Discussion

IA-3(3) Dynamic Address Allocation - Discussion
Family: Identification and Authentication (IA) > IA-3 Device Identification and Authentication

The Dynamic Host Configuration Protocol (DHCP) is an example of a means by which clients can dynamically receive network address assignments.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-3 > IA-3(3)

IA-3(3) Device Identification and Authentication | Dynamic Address Allocation
Family: Identification and Authentication (IA) > IA-3 Device Identification and Authentication

(a) Where addresses are allocated dynamically, standardize dynamic address allocation lease information and the lease duration assigned to devices in accordance with [Assignment: organization-defined organization-defined lease information and lease duration] ; and
(b) Audit lease information when assigned to a device.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-3 > IA-3(4) > Discussion

IA-3(4) Device Attestation - Discussion
Family: Identification and Authentication (IA) > IA-3 Device Identification and Authentication

Device attestation refers to the identification and authentication of a device based on its configuration and known operating state. Device attestation can be determined via a cryptographic hash of the device. If device attestation is the means of identification and authentication, then it is important that patches and updates to the device are handled via a configuration management process such that the patches and updates are done securely and do not disrupt identification and authentication to other devices.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-3 > IA-3(4)

IA-3(4) Device Identification and Authentication | Device Attestation
Family: Identification and Authentication (IA) > IA-3 Device Identification and Authentication

Handle device identification and authentication based on attestation by [Assignment: organization-defined configuration management process].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-4

IA-4 Identifier Management
Family: Identification and Authentication (IA)

Manage system identifiers by:
a. Receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, service, or device identifier;
b. Selecting an identifier that identifies an individual, group, role, service, or device;
c. Assigning the identifier to the intended individual, group, role, service, or device; and
d. Preventing reuse of identifiers for [Assignment: organization-defined time period].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-4 > Discussion

IA-4 Identifier Management - Discussion
Family: Identification and Authentication (IA)

Common device identifiers include Media Access Control (MAC) addresses, Internet Protocol (IP) addresses, or device-unique token identifiers. The management of individual identifiers is not applicable to shared system accounts. Typically, individual identifiers are the usernames of the system accounts assigned to those individuals. In such instances, the account management activities of [AC-2](#ac-2) use account names provided by [IA-4](#ia-4) . Identifier management also addresses individual identifiers not necessarily associated with system accounts. Preventing the reuse of identifiers implies preventing the assignment of previously used individual, group, role, service, or device identifiers to different individuals, groups, roles, services, or devices.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-4 > IA-4(1) > Discussion

IA-4(1) Prohibit Account Identifiers as Public Identifiers - Discussion
Family: Identification and Authentication (IA) > IA-4 Identifier Management

Prohibiting account identifiers as public identifiers applies to any publicly disclosed account identifier used for communication such as, electronic mail and instant messaging. Prohibiting the use of systems account identifiers that are the same as some public identifier, such as the individual identifier section of an electronic mail address, makes it more difficult for adversaries to guess user identifiers. Prohibiting account identifiers as public identifiers without the implementation of other supporting controls only complicates guessing of identifiers. Additional protections are required for authenticators and credentials to protect the account.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-4 > IA-4(1)

IA-4(1) Identifier Management | Prohibit Account Identifiers as Public Identifiers
Family: Identification and Authentication (IA) > IA-4 Identifier Management

Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-4 > IA-4(4) > Discussion

IA-4(4) Identify User Status - Discussion
Family: Identification and Authentication (IA) > IA-4 Identifier Management

Characteristics that identify the status of individuals include contractors, foreign nationals, and non-organizational users. Identifying the status of individuals by these characteristics provides additional information about the people with whom organizational personnel are communicating. For example, it might be useful for a government employee to know that one of the individuals on an email message is a contractor.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-4 > IA-4(4)

IA-4(4) Identifier Management | Identify User Status
Family: Identification and Authentication (IA) > IA-4 Identifier Management

Manage individual identifiers by uniquely identifying each individual as [Assignment: organization-defined characteristics].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-4 > IA-4(5) > Discussion

IA-4(5) Dynamic Management - Discussion
Family: Identification and Authentication (IA) > IA-4 Identifier Management

In contrast to conventional approaches to identification that presume static accounts for preregistered users, many distributed systems establish identifiers at runtime for entities that were previously unknown. When identifiers are established at runtime for previously unknown entities, organizations can anticipate and provision for the dynamic establishment of identifiers. Pre-established trust relationships and mechanisms with appropriate authorities to validate credentials and related identifiers are essential.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-4 > IA-4(5)

IA-4(5) Identifier Management | Dynamic Management
Family: Identification and Authentication (IA) > IA-4 Identifier Management

Manage individual identifiers dynamically in accordance with [Assignment: organization-defined dynamic identifier policy].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-4 > IA-4(6) > Discussion

IA-4(6) Cross-organization Management - Discussion
Family: Identification and Authentication (IA) > IA-4 Identifier Management

Cross-organization identifier management provides the capability to identify individuals, groups, roles, or devices when conducting cross-organization activities involving the processing, storage, or transmission of information.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-4 > IA-4(6)

IA-4(6) Identifier Management | Cross-organization Management
Family: Identification and Authentication (IA) > IA-4 Identifier Management

Coordinate with the following external organizations for cross-organization management of identifiers: [Assignment: organization-defined external organizations].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-4 > IA-4(8) > Discussion

IA-4(8) Pairwise Pseudonymous Identifiers - Discussion
Family: Identification and Authentication (IA) > IA-4 Identifier Management

A pairwise pseudonymous identifier is an opaque unguessable subscriber identifier generated by an identity provider for use at a specific individual relying party. Generating distinct pairwise pseudonymous identifiers with no identifying information about a subscriber discourages subscriber activity tracking and profiling beyond the operational requirements established by an organization. The pairwise pseudonymous identifiers are unique to each relying party except in situations where relying parties can show a demonstrable relationship justifying an operational need for correlation, or all parties consent to being correlated in such a manner.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-4 > IA-4(8)

IA-4(8) Identifier Management | Pairwise Pseudonymous Identifiers
Family: Identification and Authentication (IA) > IA-4 Identifier Management

Generate pairwise pseudonymous identifiers.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-4 > IA-4(9) > Discussion

IA-4(9) Attribute Maintenance and Protection - Discussion
Family: Identification and Authentication (IA) > IA-4 Identifier Management

For each of the entities covered in [IA-2](#ia-2), [IA-3](#ia-3), [IA-8](#ia-8) , and [IA-9](#ia-9) , it is important to maintain the attributes for each authenticated entity on an ongoing basis in a central (protected) store.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-4 > IA-4(9)

IA-4(9) Identifier Management | Attribute Maintenance and Protection
Family: Identification and Authentication (IA) > IA-4 Identifier Management

Maintain the attributes for each uniquely identified individual, device, or service in [Assignment: organization-defined protected central storage].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5

IA-5 Authenticator Management
Family: Identification and Authentication (IA)

Manage system authenticators by:
a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator;
b. Establishing initial authenticator content for any authenticators issued by the organization;
c. Ensuring that authenticators have sufficient strength of mechanism for their intended use;
d. Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators;
e. Changing default authenticators prior to first use;
f. Changing or refreshing authenticators [Assignment: organization-defined time period by authenticator type] or when [Assignment: organization-defined events] occur;
g. Protecting authenticator content from unauthorized disclosure and modification;
h. Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and
i. Changing authenticators for group or role accounts when membership to those accounts changes.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > Discussion

IA-5 Authenticator Management - Discussion
Family: Identification and Authentication (IA)

Authenticators include passwords, cryptographic devices, biometrics, certificates, one-time password devices, and ID badges. Device authenticators include certificates and passwords. Initial authenticator content is the actual content of the authenticator (e.g., the initial password). In contrast, the requirements for authenticator content contain specific criteria or characteristics (e.g., minimum password length). Developers may deliver system components with factory default authentication credentials (i.e., passwords) to allow for initial installation and configuration. Default authentication credentials are often well known, easily discoverable, and present a significant risk. The requirement to protect individual authenticators may be implemented via control [PL-4](#pl-4) or [PS-6](#ps-6) for authenticators in the possession of individuals and by controls [AC-3](#ac-3), [AC-6](#ac-6) , and [SC-28](#sc-28) for authenticators stored in organizational systems, including passwords stored in hashed or encrypted formats or files containing encrypted or hashed passwords accessible with administrator privileges.

Systems support authenticator management by organization-defined settings and restrictions for various authenticator characteristics (e.g., minimum password length, validation time window for time synchronous one-time tokens, and number of allowed rejections during the verification stage of biometric authentication). Actions can be taken to safeguard individual authenticators, including maintaining possession of authenticators, not sharing authenticators with others, and immediately reporting lost, stolen, or compromised authenticators. Authenticator management includes issuing and revoking authenticators for temporary access when no longer needed.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(1) > Discussion

IA-5(1) Password-based Authentication - Discussion
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Password-based authentication applies to passwords regardless of whether they are used in single-factor or multi-factor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(1)

IA-5(1) Authenticator Management | Password-based Authentication
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

For password-based authentication:
(a) Maintain a list of commonly-used, expected, or compromised passwords and update the list [Assignment: organization-defined frequency] and when organizational passwords are suspected to have been compromised directly or indirectly;
(b) Verify, when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5(1)(a);
(c) Transmit passwords only over cryptographically-protected channels;
(d) Store passwords using an approved salted key derivation function, preferably using a keyed hash;
(e) Require immediate selection of a new password upon account recovery;
(f) Allow user selection of long passwords and passphrases, including spaces and all printable characters;
(g) Employ automated tools to assist the user in selecting strong password authenticators; and
(h) Enforce the following composition and complexity rules: [Assignment: organization-defined composition and complexity rules].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(2) > Discussion

IA-5(2) Public Key-based Authentication - Discussion
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

Public key cryptography is a valid authentication mechanism for individuals, machines, and devices. For PKI solutions, status information for certification paths includes certificate revocation lists or certificate status protocol responses. For PIV cards, certificate validation involves the construction and verification of a certification path to the Common Policy Root trust anchor, which includes certificate policy processing. Implementing a local cache of revocation data to support path discovery and validation also supports system availability in situations where organizations are unable to access revocation information via the network.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-5 > IA-5(2)

IA-5(2) Authenticator Management | Public Key-based Authentication
Family: Identification and Authentication (IA) > IA-5 Authenticator Management

(a) For public key-based authentication:
(1) Enforce authorized access to the corresponding private key; and
(2) Map the authenticated identity to the account of the individual or group; and
(b) When public key infrastructure (PKI) is used:
(1) Validate certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information; and
(2) Implement a local cache of revocation data to support path discovery and validation.