IA-12(4): In-person Validation and Verification
Control Family:
Parent Control:
CSF v2.0 References:
Threats Addressed:
Baselines:
- High
- OT High (SP 800-82r3)
Control is new to this version of the control set and incorporates the following items from the previous version: IA-4(7): In-Person Registration, IA-5(3): In-Person Or Trusted Third-Party Registration.
Control Statement
Require that the validation and verification of identity evidence be conducted in person before a designated registration authority.
Supplemental Guidance
In-person proofing reduces the likelihood of fraudulent credentials being issued because it requires the physical presence of individuals, the presentation of physical identity documents, and actual face-to-face interactions with designated registration authorities.
OT Discussion
If the organization already performs these controls, existing organizational processes should be leveraged. For example, HR may provide a system for tracking identity evidence. OT does not need to develop an independent system for achieving this control.