# Identification and Authentication Policy

**Template version:** 1.0.0 · **Baseline:** Moderate · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/ia/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

## Purpose

This policy states what [Organization name] requires for Identification and Authentication, and who is accountable for meeting those requirements. (IA-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (IA-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (IA-1a.1(a))
- The [Fill in: an official to manage the identification and authentication policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (IA-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (IA-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (IA-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (IA-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (IA-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (IA-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (IA-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (IA-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (IA-1a.1(a))

## Procedures

The [Fill in: an official to manage the identification and authentication policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (IA-1a.2)

## Dissemination

- The [Fill in: an official to manage the identification and authentication policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the identification and authentication policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (IA-1a)
- The [Fill in: an official to manage the identification and authentication policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the identification and authentication procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (IA-1a)

## Policy statements

### Identification and authentication (organizational users) (IA-2)

- The [System owner] shall ensure the system uniquely identifies and authenticates organizational users. (IA-2)
- The [System owner] shall ensure the system associates that unique identification with processes acting on behalf of those users. (IA-2)

### Multi-factor authentication to privileged accounts (IA-2(1))

- The [System owner] shall implement multi-factor authentication for access to privileged accounts. (IA-2(1))

### Multi-factor authentication to non-privileged accounts (IA-2(2))

- The [System owner] shall implement multi-factor authentication for access to non-privileged accounts. (IA-2(2))

### Access to accounts: replay resistant (IA-2(8))

- The [System owner] shall implement replay-resistant authentication mechanisms for access to [Select one or more: privileged accounts; non-privileged accounts. Typical: privileged accounts and non-privileged accounts]. (IA-2(8))

### Acceptance of PIV credentials (IA-2(12))

- Where the organization issues or relies on Personal Identity Verification (PIV)-compliant credentials, the [System owner] shall ensure the system accepts and electronically verifies them. (IA-2(12))

#### Federal systems

Federal employees and contractors are issued PIV credentials under Homeland Security Presidential Directive 12 (HSPD-12) and [FIPS 201-3](https://csrc.nist.gov/pubs/fips/201-3/final), Personal Identity Verification (PIV) of Federal Employees and Contractors (January 2022).

- The [System owner] shall ensure the system accepts and electronically verifies PIV credentials for organizational users. (IA-2(12))

### Device identification and authentication (IA-3)

- The [System owner] shall ensure the system uniquely identifies and authenticates [Fill in: devices and/or types of devices to be uniquely identified and authenticated before establishing a connection. Typical: all organization-managed endpoints, servers and network devices] before establishing a [Select one or more: local; remote; network. Typical: remote and network] connection. (IA-3)

### Identifier management (IA-4)

- The [Account manager] shall assign an individual, group, role, service or device identifier only with authorization from [Fill in: personnel or roles from whom authorization must be received to assign an identifier. Typical: the system owner, through the approved access request]. (IA-4a)
- The [Account manager] shall select an identifier that identifies the individual, group, role, service or device. (IA-4b)
- The [Account manager] shall assign the identifier to the intended individual, group, role, service or device. (IA-4c)
- The [Account manager] shall prevent reuse of identifiers for [Fill in: a time period for preventing reuse of identifiers. Typical: at least two years]. (IA-4d)

### Identify user status (IA-4(4))

- The [Account manager] shall manage individual identifiers so that each individual is uniquely identified as [Fill in: characteristics used to identify individual status. Typical: employee, contractor, or foreign national]. (IA-4(4))

### Authenticator management (IA-5)

- The [Account manager] shall verify the identity of the individual, group, role, service or device receiving an authenticator as part of its initial distribution. (IA-5a)
- The [Account manager] shall establish the initial content of any authenticator the organization issues. (IA-5b)
- The [Chief Information Security Officer] shall ensure authenticators have sufficient strength of mechanism for their intended use. (IA-5c)
- The [Chief Information Security Officer] shall establish administrative procedures for initial authenticator distribution, for lost, compromised or damaged authenticators, and for revoking authenticators. (IA-5d)
- The [Account manager] shall implement those procedures. (IA-5d)
- The [System owner] shall ensure default authenticators are changed before first use. (IA-5e)
- The [Account manager] shall change or refresh authenticators as follows: [Fill in: a time period for changing or refreshing authenticators by authenticator type. Typical: no scheduled change for user passwords; certificates at expiry; shared and service account secrets at least annually]. (IA-5f)
- The [Account manager] shall change or refresh authenticators when [Fill in: events that trigger the change or refreshment of authenticators. Typical: evidence or suspicion of compromise, and departure of a person who knew a shared authenticator] occur. (IA-5f)
- The [System owner] shall protect authenticator content from unauthorized disclosure and modification. (IA-5g)
- Users shall protect their authenticators as the rules of behavior require. (IA-5h)
- The [System owner] shall ensure devices implement the controls that protect authenticators. (IA-5h)
- The [Account manager] shall change the authenticators of group or role accounts when membership of those accounts changes. (IA-5i)

### Password-based authentication (IA-5(1))

- The [System owner] shall maintain a list of commonly used, expected or compromised passwords, and update it [Fill in: the frequency at which to update the list of commonly used, expected, or compromised passwords. Typical: at least monthly, and whenever a relevant breach corpus is published] and when organizational passwords are suspected to have been compromised. (IA-5(1)(a))
- The [System owner] shall ensure the system verifies, when users create or update passwords, that the passwords are not on that list. (IA-5(1)(b))
- The [System owner] shall ensure passwords are transmitted only over cryptographically protected channels. (IA-5(1)(c))
- The [System owner] shall ensure passwords are stored using an approved salted key derivation function, preferably using a keyed hash. (IA-5(1)(d))
- The [System owner] shall ensure the system requires immediate selection of a new password upon account recovery. (IA-5(1)(e))
- The [System owner] shall ensure the system allows long passwords and passphrases, including spaces and all printable characters. (IA-5(1)(f))
- The [System owner] shall employ automated tools to help users select strong passwords. (IA-5(1)(g))
- The [System owner] shall ensure the system enforces these composition and complexity rules: [Fill in: authenticator composition and complexity rules. Typical: a minimum length of 15 characters for passwords used as the only factor and 8 for passwords used with another factor, and no other composition rules]. (IA-5(1)(h))

### Public key-based authentication (IA-5(2))

- For public key-based authentication, the [System owner] shall ensure the system enforces authorized access to the corresponding private key. (IA-5(2)(a)(1))
- For public key-based authentication, the [System owner] shall ensure the system maps the authenticated identity to the account of the individual or group. (IA-5(2)(a)(2))
- When public key infrastructure is used, the [System owner] shall ensure the system validates certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status. (IA-5(2)(b)(1))
- When public key infrastructure is used, the [System owner] shall ensure the system keeps a local cache of revocation data to support path discovery and validation. (IA-5(2)(b)(2))

### Protection of authenticators (IA-5(6))

- The [System owner] shall protect authenticators commensurate with the security category of the information that their use gives access to. (IA-5(6))

### Authentication feedback (IA-6)

- The [System owner] shall ensure the system obscures feedback of authentication information during authentication, so it cannot be exploited by unauthorized individuals. (IA-6)

### Cryptographic module authentication (IA-7)

- The [System owner] shall implement mechanisms for authentication to a cryptographic module that meet the laws, executive orders, directives, policies, regulations, standards and guidelines that apply to such authentication. (IA-7)

### Identification and authentication (non-organizational users) (IA-8)

- The [System owner] shall ensure the system uniquely identifies and authenticates non-organizational users and processes acting on their behalf. (IA-8)

### Acceptance of PIV credentials from other agencies (IA-8(1))

- Where users from federal agencies access the system, the [System owner] shall ensure it accepts and electronically verifies their Personal Identity Verification (PIV)-compliant credentials. (IA-8(1))

### Acceptance of external authenticators (IA-8(2))

- The [System owner] shall ensure the system accepts only external authenticators that are NIST-compliant, such as those meeting [NIST SP 800-63B-4](https://csrc.nist.gov/pubs/sp/800/63/b/4/final) (July 2025). (IA-8(2)(a))
- The [System owner] shall document and maintain a list of accepted external authenticators. (IA-8(2)(b))

### Use of defined profiles (IA-8(4))

- The [System owner] shall ensure the system conforms to [Fill in: identity management profiles. Typical: the federation profiles the organization publishes for its identity provider, such as SAML 2.0 or OpenID Connect] for identity management. (IA-8(4))

### Re-authentication (IA-11)

- The [System owner] shall ensure the system requires users to re-authenticate when [Fill in: circumstances or situations requiring re-authentication. Typical: a session timeout, a change of role or privilege, a privileged action, or a change of authenticators]. (IA-11)

### Identity proofing (IA-12)

- The [Account manager] shall identity proof users who require accounts for logical access, at the identity assurance level the applicable standards require, such as the NIST SP 800-63-4 digital identity guidelines. (IA-12a)
- The [Account manager] shall resolve each user identity to a unique individual. (IA-12b)
- The [Account manager] shall collect, validate and verify identity evidence. (IA-12c)

### Identity evidence (IA-12(2))

- The [Account manager] shall require evidence of individual identification to be presented to the registration authority. (IA-12(2))

### Identity evidence validation and verification (IA-12(3))

- The [Account manager] shall require presented identity evidence to be validated and verified through [Fill in: methods of validation and verification of identity evidence. Typical: checking the evidence against its issuing or an authoritative source, and confirming the applicant is the person it describes]. (IA-12(3))

### Address confirmation (IA-12(5))

- The [Account manager] shall require a [Select one: registration code; notice of proofing. Typical: registration code] to be delivered through an out-of-band channel to verify the user's address of record, physical or digital. (IA-12(5))

## Review and update

- The [Fill in: an official to manage the identification and authentication policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current identification and authentication policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current identification and authentication policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (IA-1c.1)
- The [Fill in: an official to manage the identification and authentication policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current identification and authentication procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require identification and authentication procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (IA-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (IA-1a.1(b))