IA-5(3): In-Person Or Trusted Third-Party Registration

Control Family:

Identification And Authentication

Parent Control:

IA-5: Authenticator Management

Priority:

P1: Implement P1 security controls first.

CSF v1.1 References:

PR.AC-1
PR.AC-6
PR.AC-7

Threats Addressed:

Spoofing

Baselines:

Moderate
High

Control is withdrawn in the next version of this control set and incorporated into: IA-12(4): In-person Validation and Verification.

Control Statement

The organization requires that the registration process to receive [Assignment: organization-defined types of and/or specific authenticators] be conducted [Selection: in person; by a trusted third party] before [Assignment: organization-defined registration authority] with authorization by [Assignment: organization-defined personnel or roles].