FedRAMP High
IA - Identification and Authentication

FedRAMP High IA-5: Authenticator Management

Manage authenticators; verify identity prior to issuing; establish initial content; protect.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 55 controls across 26 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 8 controls

  • 2.2.2 2.2.2 Vendor default accounts managed
  • 8.3.1 8.3.1 Access authenticated with at least one factor
  • 8.3.11 8.3.11 Tokens, smart cards and certificates individually assigned
  • 8.3.3 8.3.3 Identity verified before factor changes
  • 8.3.5 8.3.5 Initial and reset passwords unique and changed
  • 8.3.6 8.3.6 Password minimum length 12 and complexity
  • 8.3.9 8.3.9 Single-factor passwords changed every 90 days or dynamic analysis
  • 9.2.4 9.2.4 Locking of consoles in sensitive areas

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 3 controls

  • ANSSI-HYG-10 Define and Verify Password Selection and Sizing Rules
  • ANSSI-HYG-11 Protect Passwords Stored on Systems
  • ANSSI-HYG-12 Change Default Authentication Elements on Equipment and Services

Azure Security Benchmark · 3 controls

  • ASBv3-DP-6 Use a secure key management process
  • ASBv3-IM-8 Restrict the exposure of credential and secrets
  • IM-3 Manage application identities securely and automatically

C5 (Germany) · 3 controls

  • C5-IDM-08 Confidentiality of authentication information
  • C5-IDM-09 Authentication mechanisms
  • C5-PSS-07 Confidentiality of Authentication Information

CIS Controls v8 · 3 controls

  • CIS-4.7 Manage Default Accounts on Enterprise Assets and Software
  • CIS-5.2 Use Unique Passwords
  • CIS-6.6 Establish and Maintain an Inventory of Authentication and Authorization Systems

ISO 27001:2022 · 3 controls

  • 5.16 Identity management
  • 5.17 Authentication information
  • 8.5 Secure authentication

ISO 27002:2022 · 3 controls

  • 5.16 Identity management
  • 5.17 Authentication information
  • 8.5 Secure authentication

SOC 2 · 3 controls

  • SOC2-CC6.1 CC6.1 Logical access security over protected information assets
  • SOC2-CC6.2 CC6.2 Registering and authorising users before issuing credentials
  • SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties

UK Cyber Essentials · 3 controls

  • CE-FW.2 Change Default Firewall Passwords
  • CE-SC.2 Change Default Passwords on Devices and Software
  • CE-SC.8 Process for Compromised Passwords

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-21 Disable local administrator accounts (Excellent)
  • ASD37-23 Protect authentication credentials (Excellent)

AWS Well-Architected Security Pillar · 2 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

HIPAA Security Rule · 2 controls

NIST Cybersecurity Framework 2.0 · 2 controls

  • NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization
  • NIST-CSF-PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions

NIST SP 800-66 Rev 2 · 2 controls

ACSC Essential Eight · 1 control

  • E8-ADMIN-ML2 Restrict Administrative Privileges (ML2)

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment

Australia My Health Records Act 2012 · 1 control

  • MYHR-SEC-2 Access controls and user account management

CMMC 2.0 · 1 control

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-172 · 1 control

NIST SP 800-53 Rev 5 · 1 control

NIST SP 800-53 Rev 5 HIGH · 1 control

  • IA-5 IA-5 Authenticator Management

NIST SP 800-53 Rev 5 LOW · 1 control

  • IA-5 IA-5 Authenticator Management

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • IA-5 IA-5 Authenticator Management

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in IA - Identification and Authentication

You are reading one control. How much of FedRAMP High have you already done?

FedRAMP High IA-5 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of FedRAMP High your existing evidence covers. Hold C5 (Germany) and 119 of 410 FedRAMP High controls already carry evidence.

If you hold C5 (Germany)29% covered · 291 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 6 were rejected on the C5 (Germany) pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 55 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll FedRAMP High controls