IA-4 Identifier Management

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	6 (1 in a baseline)

Related controls: AC-5, IA-2, IA-3, IA-5, IA-8, IA-9, IA-12, MA-4, PE-2, PE-3, PE-4, PL-4, PM-12, PS-3, PS-4, PS-5, SC-37

Control statement

Manage system identifiers by:

• a. Receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, service, or device identifier;
• b. Selecting an identifier that identifies an individual, group, role, service, or device;
• c. Assigning the identifier to the intended individual, group, role, service, or device; and
• d. Preventing reuse of identifiers for [Assignment: organization-defined time period].

NIST discussion

Common device identifiers include Media Access Control (MAC) addresses, Internet Protocol (IP) addresses, or device-unique token identifiers. The management of individual identifiers is not applicable to shared system accounts. Typically, individual identifiers are the usernames of the system accounts assigned to those individuals. In such instances, the account management activities of AC-2 use account names provided by IA-4 . Identifier management also addresses individual identifiers not necessarily associated with system accounts. Preventing the reuse of identifiers implies preventing the assignment of previously used individual, group, role, service, or device identifiers to different individuals, groups, roles, services, or devices.

Control enhancements

IA-4(1) Prohibit Account Identifiers as Public Identifiers

Baselines: Not in a baseline

Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts.

Discussion and assessment objectives for IA-4(1)

Prohibiting account identifiers as public identifiers applies to any publicly disclosed account identifier used for communication such as, electronic mail and instant messaging. Prohibiting the use of systems account identifiers that are the same as some public identifier, such as the individual identifier section of an electronic mail address, makes it more difficult for adversaries to guess user identifiers. Prohibiting account identifiers as public identifiers without the implementation of other supporting controls only complicates guessing of identifiers. Additional protections are required for authenticators and credentials to protect the account.

Determine if the use of system account identifiers that are the same as public identifiers is prohibited for individual accounts.

Examine: Identification and authentication policy; system security plan; procedures addressing identifier management; procedures addressing account management; system design documentation; system configuration settings and associated documentation; system audit records; other relevant documents or records.

Interview: Organizational personnel with identifier management responsibilities; organizational personnel with information security responsibilities; system/network administrators.

Test: Mechanisms supporting and/or implementing identifier management.

IA-4(4) Identify User Status

Baselines: Moderate, High

Manage individual identifiers by uniquely identifying each individual as [Assignment: organization-defined characteristics].

Discussion and assessment objectives for IA-4(4)

Characteristics that identify the status of individuals include contractors, foreign nationals, and non-organizational users. Identifying the status of individuals by these characteristics provides additional information about the people with whom organizational personnel are communicating. For example, it might be useful for a government employee to know that one of the individuals on an email message is a contractor.

Determine if individual identifiers are managed by uniquely identifying each individual as [Assignment: organization-defined characteristics].

Examine: Identification and authentication policy; system security plan; procedures addressing identifier management; procedures addressing account management; list of characteristics identifying individual status; other relevant documents or records.

Interview: Organizational personnel with identifier management responsibilities; organizational personnel with information security responsibilities; system/network administrators.

Test: Mechanisms supporting and/or implementing identifier management.

IA-4(5) Dynamic Management

Baselines: Not in a baseline

Manage individual identifiers dynamically in accordance with [Assignment: organization-defined dynamic identifier policy].

Discussion and assessment objectives for IA-4(5)

In contrast to conventional approaches to identification that presume static accounts for preregistered users, many distributed systems establish identifiers at runtime for entities that were previously unknown. When identifiers are established at runtime for previously unknown entities, organizations can anticipate and provision for the dynamic establishment of identifiers. Pre-established trust relationships and mechanisms with appropriate authorities to validate credentials and related identifiers are essential.

Determine if individual identifiers are dynamically managed in accordance with [Assignment: organization-defined dynamic identifier policy].

Examine: Identification and authentication policy; system security plan; procedures addressing identifier management; procedures addressing account management; system design documentation; system configuration settings and associated documentation; system audit records; other relevant documents or records.

Interview: Organizational personnel with identifier management responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers.

Test: Mechanisms supporting and/or implementing dynamic identifier management.

IA-4(6) Cross-organization Management

Baselines: Not in a baseline

Coordinate with the following external organizations for cross-organization management of identifiers: [Assignment: organization-defined external organizations].

Discussion and assessment objectives for IA-4(6)

Cross-organization identifier management provides the capability to identify individuals, groups, roles, or devices when conducting cross-organization activities involving the processing, storage, or transmission of information.

Determine if cross-organization management of identifiers is coordinated with [Assignment: organization-defined external organizations].

Examine: Identification and authentication policy; procedures addressing identifier management; procedures addressing account management; system security plan; other relevant documents or records.

Interview: Organizational personnel with identifier management responsibilities; organizational personnel with information security responsibilities.

Test: Mechanisms supporting and/or implementing identifier management.

IA-4(8) Pairwise Pseudonymous Identifiers

Baselines: Not in a baseline

Generate pairwise pseudonymous identifiers.

Discussion and assessment objectives for IA-4(8)

A pairwise pseudonymous identifier is an opaque unguessable subscriber identifier generated by an identity provider for use at a specific individual relying party. Generating distinct pairwise pseudonymous identifiers with no identifying information about a subscriber discourages subscriber activity tracking and profiling beyond the operational requirements established by an organization. The pairwise pseudonymous identifiers are unique to each relying party except in situations where relying parties can show a demonstrable relationship justifying an operational need for correlation, or all parties consent to being correlated in such a manner.

Determine if pairwise pseudonymous identifiers are generated.

Examine: Identification and authentication policy; system security plan; procedures addressing identifier management; procedures addressing account management; system design documentation; system configuration settings and associated documentation; system audit records; other relevant documents or records.

Interview: Organizational personnel with identifier management responsibilities; organizational personnel with information security responsibilities.

Test: Mechanisms supporting and/or implementing identifier management.

IA-4(9) Attribute Maintenance and Protection

Baselines: Not in a baseline

Maintain the attributes for each uniquely identified individual, device, or service in [Assignment: organization-defined protected central storage].

Discussion and assessment objectives for IA-4(9)

For each of the entities covered in IA-2, IA-3, IA-8 , and IA-9 , it is important to maintain the attributes for each authenticated entity on an ongoing basis in a central (protected) store.

Determine if the attributes for each uniquely identified individual, device, or service are maintained in [Assignment: organization-defined protected central storage].

Examine: Identification and authentication policy; system security plan; procedures addressing identifier management; procedures addressing account management; system design documentation; system configuration settings and associated documentation; system audit records; other relevant documents or records.

Interview: Organizational personnel with identifier management responsibilities; organizational personnel with information security responsibilities.

Test: Mechanisms supporting and/or implementing identifier management.

Withdrawn enhancements: IA-4(2), IA-4(3), IA-4(7).

Assessment objectives (SP 800-53A)

Objectives and methods for IA-4

Determine if:

• IA-04a. system identifiers are managed by receiving authorization from [Assignment: organization-defined personnel or roles] to assign to an individual, group, role, or device identifier;
• IA-04b. system identifiers are managed by selecting an identifier that identifies an individual, group, role, service, or device;
• IA-04c. system identifiers are managed by assigning the identifier to the intended individual, group, role, service, or device;
• IA-04d. system identifiers are managed by preventing reuse of identifiers for [Assignment: organization-defined time period].

Examine: Identification and authentication policy; procedures addressing identifier management; procedures addressing account management; system security plan; system design documentation; system configuration settings and associated documentation; list of system accounts; list of identifiers generated from physical access control devices; other relevant documents or records.

Interview: Organizational personnel with identifier management responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers.

Test: Mechanisms supporting and/or implementing identifier management.

Policy statement

• The Account manager shall assign an individual, group, role, service or device identifier only with authorization from Fill in: personnel or roles from whom authorization must be received to assign an identifier Typical: the system owner, through the approved access request. (IA-4a)
• The Account manager shall select an identifier that identifies the individual, group, role, service or device. (IA-4b)
• The Account manager shall assign the identifier to the intended individual, group, role, service or device. (IA-4c)
• The Account manager shall prevent reuse of identifiers for Fill in: a time period for preventing reuse of identifiers Typical: at least two years. (IA-4d)

IA-4(4) Identify user status

• The Account manager shall manage individual identifiers so that each individual is uniquely identified as Fill in: characteristics used to identify individual status Typical: employee, contractor, or foreign national. (IA-4(4))

From the Identification and Authentication Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

IA-4 covers the names the system knows its users, groups, roles, services and devices by. Each identifier is issued with authorization, names one subject, goes to the right one, and is never handed to someone else within the reuse period. AC-2 manages the accounts; IA-4 manages the identifiers those accounts use.

Common implementations. The identity provider builds usernames from the HR record and a unique employee or contractor number, so two people never share one. Accounts are created only from an approved access request, as step 6 of the onboarding, transfer and termination checklist records. When someone leaves, the account is disabled, and the identifier stays reserved rather than being deleted and reissued. Service accounts use a naming convention and record an owner. Device identifiers come from the component inventory. A directory attribute or display name marks each person’s status for IA-4(4).

Organization-defined parameters. Typical values, taken from the Identification and Authentication policy, which your organization may set differently:

Parameter	Typical value
Who authorizes an identifier (a)	The system owner, through the approved access request
Period during which identifiers are not reused (d)	At least two years
Characteristics that identify user status (IA-4(4))	Employee, contractor, or foreign national

Evidence assessors ask for.

• The identifier naming procedure, covering people, service accounts and devices
• A sample of identifiers traced back to their approved access requests
• The list of identifiers of people who left, compared with current accounts to show none were reissued
• Directory attributes or display names showing each user’s status, for IA-4(4)

Inheritance. The enterprise identity provider usually supplies the identifiers of people as a common control. The system owns identifiers it creates itself: local and application accounts, service accounts and its devices.

Common findings.

• A former employee’s username or email address reissued to a new hire with the same name.
• Generic identifiers such as admin or test that name no person or service.
• Contractors who cannot be told apart from employees in the directory.
• Service accounts created by administrators with no request and no owner.

Enhancements in the Moderate baseline. IA-4(4) identify user status. High adds none.

Artifacts

• Identification and Authentication Decision Worksheet
• Identification and Authentication Policy
• Identification and Authentication Standard