Identification and Authentication Policy

Identification and Authentication Policy template: Ready-to-adopt Identification and Authentication policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and a variant per baseline (Low, Moderate, High).

Type	Program stage	Status	Template version	NIST basis
Policy	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The Identification and Authentication policy states what the organization requires for identification and authentication and who is accountable for it. It meets IA-1 through the sections every family policy shares, and adds one statement group per control. Each baseline variant includes only the controls in that baseline, taken from the NIST SP 800-53B profiles.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

“Yes” marks the baseline variants that include the control’s statements. IA-1 is met by the common sections.

Control	Title	Low	Moderate	High	Privacy
IA-1	Policy and Procedures	Yes	Yes	Yes
IA-2	Identification and Authentication (Organizational Users)	Yes	Yes	Yes
IA-2(1)	Multi-factor Authentication to Privileged Accounts	Yes	Yes	Yes
IA-2(2)	Multi-factor Authentication to Non-privileged Accounts	Yes	Yes	Yes
IA-2(5)	Individual Authentication with Group Authentication			Yes
IA-2(8)	Access to Accounts — Replay Resistant	Yes	Yes	Yes
IA-2(12)	Acceptance of PIV Credentials	Yes	Yes	Yes
IA-3	Device Identification and Authentication		Yes	Yes
IA-4	Identifier Management	Yes	Yes	Yes
IA-4(4)	Identify User Status		Yes	Yes
IA-5	Authenticator Management	Yes	Yes	Yes
IA-5(1)	Password-based Authentication	Yes	Yes	Yes
IA-5(2)	Public Key-based Authentication		Yes	Yes
IA-5(6)	Protection of Authenticators		Yes	Yes
IA-6	Authentication Feedback	Yes	Yes	Yes
IA-7	Cryptographic Module Authentication	Yes	Yes	Yes
IA-8	Identification and Authentication (Non-organizational Users)	Yes	Yes	Yes
IA-8(1)	Acceptance of PIV Credentials from Other Agencies	Yes	Yes	Yes
IA-8(2)	Acceptance of External Authenticators	Yes	Yes	Yes
IA-8(4)	Use of Defined Profiles	Yes	Yes	Yes
IA-11	Re-authentication	Yes	Yes	Yes
IA-12	Identity Proofing		Yes	Yes
IA-12(2)	Identity Evidence		Yes	Yes
IA-12(3)	Identity Evidence Validation and Verification		Yes	Yes
IA-12(4)	In-person Validation and Verification			Yes
IA-12(5)	Address Confirmation		Yes	Yes

Decisions to make first

The policy has 22 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Which multi-factor methods are accepted, and which are phishing-resistant enough for privileged access?	IA-2(1), IA-2(2), IA-2(8)	FIDO2 security keys, platform authenticators or PKI smart cards for privileged users; authenticator apps with number matching as a minimum for everyone else.	Chief Information Security Officer
Which identity provider authenticates users, and which systems may keep local accounts?	IA-2, IA-8	One organization identity provider for all users; local accounts only for break-glass and service use, recorded in the security plan.	Chief Information Security Officer

Record your values in the Identification and Authentication decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Low	Word · Markdown	Word · Markdown
Moderate	Word · Markdown	Word · Markdown
High	Word · Markdown	Word · Markdown

Everything for this family in one file: IA pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (Moderate baseline, annotated)

Guidance

The sections before and after Policy statements meet IA-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the IA-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

Purpose

This policy states what Organization name requires for Identification and Authentication, and who is accountable for meeting those requirements. (IA-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (IA-1a.1(a))

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and shall approve exceptions to it. (IA-1a.1(a))
• The Fill in: an official to manage the identification and authentication policy and procedures Typical: Chief Information Security Officer shall manage the development, documentation and dissemination of this policy and its procedures. (IA-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (IA-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (IA-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (IA-1a.1(a))

Coordination

The Chief Information Security Officer shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (IA-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (IA-1a.1(b))
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (IA-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (IA-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (IA-1a.1(a))

Procedures

The Fill in: an official to manage the identification and authentication policy and procedures Typical: Chief Information Security Officer shall ensure that documented procedures exist to implement this policy and its associated controls. (IA-1a.2)

Dissemination

• The Fill in: an official to manage the identification and authentication policy and procedures Typical: Chief Information Security Officer shall disseminate this policy to Fill in: personnel or roles to whom the identification and authentication policy is to be disseminated Typical: everyone within its scope, through the policy library. (IA-1a)
• The Fill in: an official to manage the identification and authentication policy and procedures Typical: Chief Information Security Officer shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom the identification and authentication procedures are to be disseminated Typical: the people who carry them out, and the system owners. (IA-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

Identification and authentication (organizational users) (IA-2)

Guidance

The identification and authentication standard makes the IA-2 statements measurable: the assurance level for each group of users, the approved authenticators, which are required for privileged and non-privileged access, and a part where each system records how its users authenticate.

• The System owner shall ensure the system uniquely identifies and authenticates organizational users. (IA-2)
• The System owner shall ensure the system associates that unique identification with processes acting on behalf of those users. (IA-2)

Multi-factor authentication to privileged accounts (IA-2(1))

• The System owner shall implement multi-factor authentication for access to privileged accounts. (IA-2(1))

Multi-factor authentication to non-privileged accounts (IA-2(2))

• The System owner shall implement multi-factor authentication for access to non-privileged accounts. (IA-2(2))

Access to accounts: replay resistant (IA-2(8))

• The System owner shall implement replay-resistant authentication mechanisms for access to Select one or more: privileged accounts; non-privileged accounts Typical: privileged accounts and non-privileged accounts. (IA-2(8))

Acceptance of PIV credentials (IA-2(12))

Guidance

Personal Identity Verification (PIV) is the U.S. federal smart card credential. An organization outside the federal government meets this enhancement where it relies on PIV or PIV-interoperable credentials; if it uses none, record the enhancement as not applicable in the system security plan with that reason.

• Where the organization issues or relies on Personal Identity Verification (PIV)-compliant credentials, the System owner shall ensure the system accepts and electronically verifies them. (IA-2(12))

Federal systems

Federal employees and contractors are issued PIV credentials under Homeland Security Presidential Directive 12 (HSPD-12) and FIPS 201-3, Personal Identity Verification (PIV) of Federal Employees and Contractors (January 2022).

• The System owner shall ensure the system accepts and electronically verifies PIV credentials for organizational users. (IA-2(12))

Device identification and authentication (IA-3)

• The System owner shall ensure the system uniquely identifies and authenticates Fill in: devices and/or types of devices to be uniquely identified and authenticated before establishing a connection Typical: all organization-managed endpoints, servers and network devices before establishing a Select one or more: local; remote; network Typical: remote and network connection. (IA-3)

Identifier management (IA-4)

• The Account manager shall assign an individual, group, role, service or device identifier only with authorization from Fill in: personnel or roles from whom authorization must be received to assign an identifier Typical: the system owner, through the approved access request. (IA-4a)
• The Account manager shall select an identifier that identifies the individual, group, role, service or device. (IA-4b)
• The Account manager shall assign the identifier to the intended individual, group, role, service or device. (IA-4c)
• The Account manager shall prevent reuse of identifiers for Fill in: a time period for preventing reuse of identifiers Typical: at least two years. (IA-4d)

Identify user status (IA-4(4))

• The Account manager shall manage individual identifiers so that each individual is uniquely identified as Fill in: characteristics used to identify individual status Typical: employee, contractor, or foreign national. (IA-4(4))

Authenticator management (IA-5)

Guidance

For passwords, NIST SP 800-63B-4 (July 2025) says verifiers shall not require periodic changes, and shall force a change when there is evidence of compromise. Set the change periods below by authenticator type, and keep scheduled changes for secrets such as shared or service account keys. The identification and authentication standard carries the procedures these statements call for: identity checks before issue and reset, binding, recovery, loss and revocation.

• The Account manager shall verify the identity of the individual, group, role, service or device receiving an authenticator as part of its initial distribution. (IA-5a)
• The Account manager shall establish the initial content of any authenticator the organization issues. (IA-5b)
• The Chief Information Security Officer shall ensure authenticators have sufficient strength of mechanism for their intended use. (IA-5c)
• The Chief Information Security Officer shall establish administrative procedures for initial authenticator distribution, for lost, compromised or damaged authenticators, and for revoking authenticators. (IA-5d)
• The Account manager shall implement those procedures. (IA-5d)
• The System owner shall ensure default authenticators are changed before first use. (IA-5e)
• The Account manager shall change or refresh authenticators as follows: Fill in: a time period for changing or refreshing authenticators by authenticator type Typical: no scheduled change for user passwords; certificates at expiry; shared and service account secrets at least annually. (IA-5f)
• The Account manager shall change or refresh authenticators when Fill in: events that trigger the change or refreshment of authenticators Typical: evidence or suspicion of compromise, and departure of a person who knew a shared authenticator occur. (IA-5f)
• The System owner shall protect authenticator content from unauthorized disclosure and modification. (IA-5g)
• Users shall protect their authenticators as the rules of behavior require. (IA-5h)
• The System owner shall ensure devices implement the controls that protect authenticators. (IA-5h)
• The Account manager shall change the authenticators of group or role accounts when membership of those accounts changes. (IA-5i)

Password-based authentication (IA-5(1))

Guidance

The typical values follow NIST SP 800-63B-4 (July 2025): a minimum of 15 characters for a password used alone and 8 when it is one factor of several, no other composition rules, at least 64 characters allowed, and a check against a list of common and breached passwords. Section 7 of the identification and authentication standard sets out the full password rules.

• The System owner shall maintain a list of commonly used, expected or compromised passwords, and update it Fill in: the frequency at which to update the list of commonly used, expected, or compromised passwords Typical: at least monthly, and whenever a relevant breach corpus is published and when organizational passwords are suspected to have been compromised. (IA-5(1)(a))
• The System owner shall ensure the system verifies, when users create or update passwords, that the passwords are not on that list. (IA-5(1)(b))
• The System owner shall ensure passwords are transmitted only over cryptographically protected channels. (IA-5(1)(c))
• The System owner shall ensure passwords are stored using an approved salted key derivation function, preferably using a keyed hash. (IA-5(1)(d))
• The System owner shall ensure the system requires immediate selection of a new password upon account recovery. (IA-5(1)(e))
• The System owner shall ensure the system allows long passwords and passphrases, including spaces and all printable characters. (IA-5(1)(f))
• The System owner shall employ automated tools to help users select strong passwords. (IA-5(1)(g))
• The System owner shall ensure the system enforces these composition and complexity rules: Fill in: authenticator composition and complexity rules Typical: a minimum length of 15 characters for passwords used as the only factor and 8 for passwords used with another factor, and no other composition rules. (IA-5(1)(h))

Public key-based authentication (IA-5(2))

• For public key-based authentication, the System owner shall ensure the system enforces authorized access to the corresponding private key. (IA-5(2)(a)(1))
• For public key-based authentication, the System owner shall ensure the system maps the authenticated identity to the account of the individual or group. (IA-5(2)(a)(2))
• When public key infrastructure is used, the System owner shall ensure the system validates certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status. (IA-5(2)(b)(1))
• When public key infrastructure is used, the System owner shall ensure the system keeps a local cache of revocation data to support path discovery and validation. (IA-5(2)(b)(2))

Protection of authenticators (IA-5(6))

• The System owner shall protect authenticators commensurate with the security category of the information that their use gives access to. (IA-5(6))

Authentication feedback (IA-6)

• The System owner shall ensure the system obscures feedback of authentication information during authentication, so it cannot be exploited by unauthorized individuals. (IA-6)

Cryptographic module authentication (IA-7)

• The System owner shall implement mechanisms for authentication to a cryptographic module that meet the laws, executive orders, directives, policies, regulations, standards and guidelines that apply to such authentication. (IA-7)

Identification and authentication (non-organizational users) (IA-8)

• The System owner shall ensure the system uniquely identifies and authenticates non-organizational users and processes acting on their behalf. (IA-8)

Acceptance of PIV credentials from other agencies (IA-8(1))

Guidance

This enhancement applies where federal employees or contractors from other agencies use the system. Outside that case, record it as not applicable in the system security plan with that reason.

• Where users from federal agencies access the system, the System owner shall ensure it accepts and electronically verifies their Personal Identity Verification (PIV)-compliant credentials. (IA-8(1))

Acceptance of external authenticators (IA-8(2))

• The System owner shall ensure the system accepts only external authenticators that are NIST-compliant, such as those meeting NIST SP 800-63B-4 (July 2025). (IA-8(2)(a))
• The System owner shall document and maintain a list of accepted external authenticators. (IA-8(2)(b))

Use of defined profiles (IA-8(4))

• The System owner shall ensure the system conforms to Fill in: identity management profiles Typical: the federation profiles the organization publishes for its identity provider, such as SAML 2.0 or OpenID Connect for identity management. (IA-8(4))

Re-authentication (IA-11)

• The System owner shall ensure the system requires users to re-authenticate when Fill in: circumstances or situations requiring re-authentication Typical: a session timeout, a change of role or privilege, a privileged action, or a change of authenticators. (IA-11)

Identity proofing (IA-12)

• The Account manager shall identity proof users who require accounts for logical access, at the identity assurance level the applicable standards require, such as the NIST SP 800-63-4 digital identity guidelines. (IA-12a)
• The Account manager shall resolve each user identity to a unique individual. (IA-12b)
• The Account manager shall collect, validate and verify identity evidence. (IA-12c)

Identity evidence (IA-12(2))

• The Account manager shall require evidence of individual identification to be presented to the registration authority. (IA-12(2))

Identity evidence validation and verification (IA-12(3))

• The Account manager shall require presented identity evidence to be validated and verified through Fill in: methods of validation and verification of identity evidence Typical: checking the evidence against its issuing or an authoritative source, and confirming the applicant is the person it describes. (IA-12(3))

Address confirmation (IA-12(5))

• The Account manager shall require a Select one: registration code; notice of proofing Typical: registration code to be delivered through an out-of-band channel to verify the user’s address of record, physical or digital. (IA-12(5))

Review and update

• The Fill in: an official to manage the identification and authentication policy and procedures Typical: Chief Information Security Officer shall review and update this policy Fill in: the frequency at which the current identification and authentication policy is reviewed and updated Typical: annually and following Fill in: events that would require the current identification and authentication policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (IA-1c.1)
• The Fill in: an official to manage the identification and authentication policy and procedures Typical: Chief Information Security Officer shall review and update the procedures that implement this policy Fill in: the frequency at which the current identification and authentication procedures are reviewed and updated Typical: annually and following Fill in: events that would require identification and authentication procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (IA-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (IA-1a.1(b))