IA-13(2): Verification of Identity Assertions and Access Tokens
Control Family:
Parent Control:
Threats Addressed:
Baselines:
(Not part of any baseline)
Control is new to this version of the control set.
Control Statement
The source and integrity of identity assertions and access tokens are verified before granting access to system and information resources.
Supplemental Guidance
This includes verification of digital signatures protecting identity assertions and access tokens, as well as included metadata. Metadata includes information about the access request such as information unique to user, system or information resource being accessed, or the transaction itself such as time. Protected system and information resources could include connected networks, applications, and APIs.