IA-3(4): Device Attestation
Control Family:
Parent Control:
Threats Addressed:
Baselines:
(Not part of any baseline)
Previous Version:
- NIST Special Publication 800-53 Revision 4:
- IA-3(4): Device Attestation
Control Statement
Handle device identification and authentication based on attestation by [Assignment: organization-defined configuration management process].
Supplemental Guidance
Device attestation refers to the identification and authentication of a device based on its configuration and known operating state. Device attestation can be determined via a cryptographic hash of the device. If device attestation is the means of identification and authentication, then it is important that patches and updates to the device are handled via a configuration management process such that the patches and updates are done securely and do not disrupt identification and authentication to other devices.
OT Discussion
For OT systems that include IIoT devices, these enhancements may be needed to protect device-to-device communication.