IA-4(4): Identify User Status
Control Family:
Parent Control:
CSF v2.0 References:
Threats Addressed:
Baselines:
- Moderate
- High
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Previous Version:
- NIST Special Publication 800-53 Revision 4:
- IA-4(4): Identify User Status
Control Statement
Manage individual identifiers by uniquely identifying each individual as [Assignment: organization-defined characteristics].
Supplemental Guidance
Characteristics that identify the status of individuals include contractors, foreign nationals, and non-organizational users. Identifying the status of individuals by these characteristics provides additional information about the people with whom organizational personnel are communicating. For example, it might be useful for a government employee to know that one of the individuals on an email message is a contractor.
OT Discussion
This control enhancement is typically implemented by the organization rather than at the system level. However, to manage risk for certain OT environments, identifiers (e.g., badges) may have different markings to indicate the status of individuals, such as contractors, foreign nationals, and non-organizational users.