IA-4: Identifier Management
Control Family:
Threats Addressed:
Baselines:
- Low
- IA-4
- Moderate
- IA-4
- High
- IA-4
Next Version:
- NIST Special Publication 800-53 Revision 5.2.0:
- IA-4: Identifier Management
Control Statement
The organization manages information system identifiers by:
- Receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, or device identifier;
- Selecting an identifier that identifies an individual, group, role, or device;
- Assigning the identifier to the intended individual, group, role, or device;
- Preventing reuse of identifiers for [Assignment: organization-defined time period]; and
- Disabling the identifier after [Assignment: organization-defined time period of inactivity].
Supplemental Guidance
Common device identifiers include, for example, media access control (MAC), Internet protocol (IP) addresses, or device-unique token identifiers. Management of individual identifiers is not applicable to shared information system accounts (e.g., guest and anonymous accounts). Typically, individual identifiers are the user names of the information system accounts assigned to those individuals. In such instances, the account management activities of AC-2 use account names provided by IA-4. This control also addresses individual identifiers not necessarily associated with information system accounts (e.g., identifiers used in physical security control databases accessed by badge reader systems for access to information systems). Preventing reuse of identifiers implies preventing the assignment of previously used individual, group, role, or device identifiers to different individuals, groups, roles, or devices.
Control Enhancements
IA-4(1): Prohibit Account Identifiers As Public Identifiers
Baseline(s):
The organization prohibits the use of information system account identifiers that are the same as public identifiers for individual electronic mail accounts.
IA-4(2): Supervisor Authorization
Baseline(s):
The organization requires that the registration process to receive an individual identifier includes supervisor authorization.
IA-4(3): Multiple Forms Of Certification
Baseline(s):
The organization requires multiple forms of certification of individual identification be presented to the registration authority.
IA-4(4): Identify User Status
Baseline(s):
The organization manages individual identifiers by uniquely identifying each individual as [Assignment: organization-defined characteristic identifying individual status].
IA-4(5): Dynamic Management
Baseline(s):
The information system dynamically manages identifiers.
IA-4(6): Cross-Organization Management
Baseline(s):
The organization coordinates with [Assignment: organization-defined external organizations] for cross-organization management of identifiers.
IA-4(7): In-Person Registration
Baseline(s):
The organization requires that the registration process to receive an individual identifier be conducted in person before a designated registration authority.