IA: Identification and Authentication
OT Tailoring Considerations
Before implementing controls in the IA family, consider the trade-offs among security, privacy, latency, performance, and throughput. For example, the organization considers whether latency induced from the use of authentication mechanisms that employ cryptography would adversely impact the operational performance of the OT.
When the OT cannot support the specific identification and authentication requirements of a control, the organization employs compensating controls in accordance with the general tailoring guidance. Examples of compensating controls are given with each control as appropriate.
Controls
IA-1: Policy and Procedures
Baseline(s):
- Low
- Moderate
- High
- OT Low (SP 800-82r3)
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: [Assignment (one or more): organization-level, mission/business process-level, system-level] identification and authentication policy that: Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and Procedures to facilitate the…
IA-2: Identification and Authentication (Organizational Users)
Baseline(s):
- Low
- Moderate
- High
- OT Low (SP 800-82r3)
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
IA-3: Device Identification and Authentication
Baseline(s):
- Moderate
- High
- OT Low (SP 800-82r3)
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Uniquely identify and authenticate [Assignment: organization-defined devices and/or types of devices] before establishing a [Assignment (one or more): local, remote, network] connection.
IA-4: Identifier Management
Baseline(s):
- Low
- Moderate
- High
- OT Low (SP 800-82r3)
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Manage system identifiers by: Receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, service, or device identifier; Selecting an identifier that identifies an individual, group, role, service, or device; Assigning the identifier to the intended individual, group, role, service, or device; and Preventing reuse of identifiers for [Assignment: organization-defined time…
IA-5: Authenticator Management
Baseline(s):
- Low
- Moderate
- High
- OT Low (SP 800-82r3)
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Manage system authenticators by: Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator; Establishing initial authenticator content for any authenticators issued by the organization; Ensuring that authenticators have sufficient strength of mechanism for their intended use; Establishing and implementing administrative procedures for initial…
IA-6: Authentication Feedback
Baseline(s):
- Low
- Moderate
- High
- OT Low (SP 800-82r3)
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.
IA-7: Cryptographic Module Authentication
Baseline(s):
- Low
- Moderate
- High
- OT Low (SP 800-82r3)
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication.
IA-8: Identification and Authentication (Non-organizational Users)
Baseline(s):
- Low
- Moderate
- High
- OT Low (SP 800-82r3)
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
IA-9: Service Identification and Authentication
Baseline(s):
Uniquely identify and authenticate [Assignment: organization-defined system services and applications] before establishing communications with devices, users, or other services or applications.
IA-10: Adaptive Authentication
Baseline(s):
Require individuals accessing the system to employ [Assignment: organization-defined supplemental authentication techniques or mechanisms] under specific [Assignment: organization-defined circumstances or situations].
IA-11: Re-authentication
Baseline(s):
- Low
- Moderate
- High
- OT Low (SP 800-82r3)
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Require users to re-authenticate when [Assignment: organization-defined circumstances or situations].
IA-12: Identity Proofing
Baseline(s):
- Moderate
- High
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines; Resolve user identities to a unique individual; and Collect, validate, and verify identity evidence.
IA-13: Identity Providers and Authorization Servers
Baseline(s):
Employ identity providers and authorization servers to manage user, device, and non-person entity (NPE) identities, attributes, and access rights supporting authentication and authorization decisions in accordance with [Assignment: organization-defined policy] using [Assignment: organization-defined mechanisms].