Identification and Authentication Decision Worksheet

Identification and Authentication Decision Worksheet template: Every decision the Identification and Authentication family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the Identification and Authentication family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every IA control in the baseline, with a typical value where the Identification and Authentication Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Low	CSV
Moderate	CSV
High	CSV

Decisions (Moderate baseline)

24 decisions.

Decision	Control	Typical value	Who decides
Which multi-factor methods are accepted, and which are phishing-resistant enough for privileged access?	IA-2(1), IA-2(2), IA-2(8)	FIDO2 security keys, platform authenticators or PKI smart cards for privileged users; authenticator apps with number matching as a minimum for everyone else.	Chief Information Security Officer
Which identity provider authenticates users, and which systems may keep local accounts?	IA-2, IA-8	One organization identity provider for all users; local accounts only for break-glass and service use, recorded in the security plan.	Chief Information Security Officer
Personnel or roles to whom the identification and authentication policy is to be disseminated	IA-1	Everyone within its scope, through the policy library	Chief Information Security Officer
Personnel or roles to whom the identification and authentication procedures are to be disseminated	IA-1	The people who carry them out, and the system owners	Chief Information Security Officer
Select one or more: organization-level; mission/business process-level; system-level	IA-1	Organization-level	Chief Information Security Officer
An official to manage the identification and authentication policy and procedures	IA-1	Chief Information Security Officer	Chief Information Security Officer
The frequency at which the current identification and authentication policy is reviewed and updated	IA-1	Annually	Chief Information Security Officer
Events that would require the current identification and authentication policy to be reviewed and updated	IA-1	Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines	Chief Information Security Officer
The frequency at which the current identification and authentication procedures are reviewed and updated	IA-1	Annually	Chief Information Security Officer
Events that would require identification and authentication procedures to be reviewed and updated	IA-1	The same events as the policy, and changes to the systems, tools or services the procedures describe	Chief Information Security Officer
Select one or more: privileged accounts; non-privileged accounts	IA-2(8)	Privileged accounts and non-privileged accounts	Chief Information Security Officer
Devices and/or types of devices to be uniquely identified and authenticated before establishing a connection	IA-3	All organization-managed endpoints, servers and network devices	Chief Information Security Officer
Select one or more: local; remote; network	IA-3	Remote and network	Chief Information Security Officer
Personnel or roles from whom authorization must be received to assign an identifier	IA-4	The system owner, through the approved access request	Chief Information Security Officer
A time period for preventing reuse of identifiers	IA-4	At least two years	Chief Information Security Officer
Characteristics used to identify individual status	IA-4(4)	Employee, contractor, or foreign national	Chief Information Security Officer
A time period for changing or refreshing authenticators by authenticator type	IA-5	No scheduled change for user passwords; certificates at expiry; shared and service account secrets at least annually	Chief Information Security Officer
Events that trigger the change or refreshment of authenticators	IA-5	Evidence or suspicion of compromise, and departure of a person who knew a shared authenticator	Chief Information Security Officer
The frequency at which to update the list of commonly used, expected, or compromised passwords	IA-5(1)	At least monthly, and whenever a relevant breach corpus is published	Chief Information Security Officer
Authenticator composition and complexity rules	IA-5(1)	A minimum length of 15 characters for passwords used as the only factor and 8 for passwords used with another factor, and no other composition rules	Chief Information Security Officer
Identity management profiles	IA-8(4)	The federation profiles the organization publishes for its identity provider, such as SAML 2.0 or OpenID Connect	Chief Information Security Officer
Circumstances or situations requiring re-authentication	IA-11	A session timeout, a change of role or privilege, a privileged action, or a change of authenticators	Chief Information Security Officer
Methods of validation and verification of identity evidence	IA-12(3)	Checking the evidence against its issuing or an authoritative source, and confirming the applicant is the person it describes	Chief Information Security Officer
Select one: registration code; notice of proofing	IA-12(5)	Registration code	Chief Information Security Officer