IA-12(2): Identity Evidence
Control Family:
Parent Control:
CSF v2.0 References:
Threats Addressed:
Baselines:
- Moderate
- High
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Control is new to this version of the control set and incorporates the following item from the previous version: IA-4(3): Multiple Forms Of Certification.
Control Statement
Require evidence of individual identification be presented to the registration authority.
Supplemental Guidance
Identity evidence, such as documentary evidence or a combination of documents and biometrics, reduces the likelihood of individuals using fraudulent identification to establish an identity or at least increases the work factor of potential adversaries. The forms of acceptable evidence are consistent with the risks to the systems, roles, and privileges associated with the user's account.
OT Discussion
If the organization already performs these controls, existing organizational processes should be leveraged. For example, HR may provide a system for tracking identity evidence. OT does not need to develop an independent system for achieving this control.