IA-9 Service Identification and Authentication
Guidance: nonePolicy clause: noneWhat these mean
ia9ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| Not in a baseline | Organization | None |
Related controls: IA-3, IA-4, IA-5, IA-13, SC-8
Control statement
Section titled “Control statement”Uniquely identify and authenticate [Assignment: organization-defined system services and applications] before establishing communications with devices, users, or other services or applications.
NIST discussion
Services that may require identification and authentication include web applications using digital certificates or services or applications that query a database. Identification and authentication methods for system services and applications include information or code signing, provenance graphs, and electronic signatures that indicate the sources of services. Decisions regarding the validity of identification and authentication claims can be made by services separate from the services acting on those decisions. This can occur in distributed system architectures. In such situations, the identification and authentication decisions (instead of actual identifiers and authentication data) are provided to the services that need to act on those decisions.
Withdrawn enhancements: IA-9(1), IA-9(2).
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for IA-9
Determine if [Assignment: organization-defined system services and applications] are uniquely identified and authenticated before establishing communications with devices, users, or other services or applications.
Examine: Identification and authentication policy; procedures addressing service identification and authentication; system security plan; system design documentation; security safeguards used to identify and authenticate system services; system configuration settings and associated documentation; system audit records; other relevant documents or records.
Interview: Organizational personnel with system operations responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers; organizational personnel with identification and authentication responsibilities.
Test: Security safeguards implementing service identification and authentication capabilities.
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.