NIST SP 800-171 Rev 3
03.05 IA (Identification and Authentication)

NIST SP 800-171 Rev 3 03.05.12: Authenticator Management

Manage authenticators by verifying identity of receiver, establishing initial content, ensuring adequate strength, secure distribution, revocation, periodic change, and protection from disclosure.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 56 controls across 22 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 8 controls

  • 2.2.2 2.2.2 Vendor default accounts managed
  • 8.3.11 8.3.11 Tokens, smart cards and certificates individually assigned
  • 8.3.3 8.3.3 Identity verified before factor changes
  • 8.3.5 8.3.5 Initial and reset passwords unique and changed
  • 8.3.6 8.3.6 Password minimum length 12 and complexity
  • 8.3.9 8.3.9 Single-factor passwords changed every 90 days or dynamic analysis
  • 8.6.2 8.6.2 No hard-coded passwords for interactive system accounts
  • 8.6.3 8.6.3 System account passwords protected against misuse

Azure Security Benchmark · 5 controls

  • ASBv3-DP-6 Use a secure key management process
  • ASBv3-DP-7 Use a secure certificate management process
  • ASBv3-DP-8 Ensure security of key and certificate repository
  • ASBv3-IM-8 Restrict the exposure of credential and secrets
  • IM-3 Manage application identities securely and automatically

FedRAMP High · 5 controls

  • IA-12 Identity Proofing (IA-12)
  • IA-5 Authenticator Management
  • IA-5(2) Public Key-Based Authentication
  • IA-5(6) Protection of Authenticators
  • IA-5(7) Authenticator Management | No Embedded Unencrypted Static Authenticators (IA-5(7))

FedRAMP Moderate · 5 controls

  • IA-12 Identity Proofing (IA-12)
  • IA-5 Authenticator Management
  • IA-5(2) Public Key-Based Authentication
  • IA-5(6) Protection of Authenticators
  • IA-5(7) Authenticator Management | No Embedded Unencrypted Static Authenticators (IA-5(7))

AWS Well-Architected Security Pillar · 4 controls

UK Cyber Essentials · 4 controls

  • CE-AC.8 Passwordless Authentication
  • CE-SC.2 Change Default Passwords on Devices and Software
  • CE-SC.5 Password-Based Authentication Quality
  • CE-SC.8 Process for Compromised Passwords

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

  • ANSSI-HYG-10 Define and Verify Password Selection and Sizing Rules
  • ANSSI-HYG-12 Change Default Authentication Elements on Equipment and Services

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-21 Disable local administrator accounts (Excellent)
  • ASD37-23 Protect authentication credentials (Excellent)

C5 (Germany) · 2 controls

  • C5-IDM-08 Confidentiality of authentication information
  • C5-PSS-07 Confidentiality of Authentication Information

CMMC 2.0 · 2 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

HIPAA Security Rule · 2 controls

NIST Cybersecurity Framework 2.0 · 2 controls

  • NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization
  • NIST-CSF-PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions

NIST SP 800-53 Rev 5 · 2 controls

NIST SP 800-66 Rev 2 · 2 controls

ACSC Essential Eight · 1 control

  • E8-ADMIN-ML2 Restrict Administrative Privileges (ML2)

CIS Controls v8 · 1 control

  • CIS-4.7 Manage Default Accounts on Enterprise Assets and Software

ISO 27001:2022 · 1 control

  • 5.17 Authentication information

ISO 27002:2022 · 1 control

  • 5.17 Authentication information

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-172 · 1 control

SOC 2 · 1 control

  • SOC2-CC6.2 CC6.2 Registering and authorising users before issuing credentials

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in 03.05 IA (Identification and Authentication)

You are reading one control. How much of NIST SP 800-171 Rev 3 have you already done?

NIST SP 800-171 Rev 3 03.05.12 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-171 Rev 3 your existing evidence covers. Hold PCI DSS 4.0 and 69 of 97 NIST SP 800-171 Rev 3 controls already carry evidence.

If you hold PCI DSS 4.071.1% covered · 28 gapsIf you hold C5 (Germany)68% covered · 31 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.164.9% covered · 34 gapsIf you hold ISO 27001:202262.9% covered · 36 gapsIf you hold CIS Controls v853.6% covered · 45 gapsIf you hold NIST SP 800-161 Rev 152.6% covered · 46 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the PCI DSS 4.0 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 56 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-171 Rev 3 controls