NIST SP 800-53 Rev 5 LOW
IA Identification and Authentication

NIST SP 800-53 Rev 5 LOW IA-5: Authenticator Management

Manage authenticators; verify identity prior to issuing; establish initial content; protect.

What else in your programme already covers this

This control maps to 52 controls across 23 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 8 controls

  • 2.2.2 Vendor default accounts are managed as follows: • If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6. • If the vendor default account(s) will not be used,
  • 8.3.1 All user access to system components for users and administrators is authenticated via at least one of the following authentication factors: • Something you know, such as a password or passphrase. • Something you
  • 8.3.11 Hardware token and other factor protection
  • 8.3.3 User identity is verified before modifying any authentication factor
  • 8.3.5 If passwords/passphrases are used as authentication factors to meet Requirement 8.3.1, they are set and reset for each user as follows: • Set to a unique value for first-time use and upon reset. •
  • 8.3.6 If passwords/passphrases are used as authentication factors to meet Requirement 8.3.1, they meet the following minimum level of complexity: • A minimum length of 12 characters (or IF the system does not support 12
  • 8.3.9 Password change frequency if only factor
  • 9.2.4 Consoles in sensitive areas locked when not in use

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 3 controls

  • ANSSI-HYG-10 Define and Verify Password Selection and Sizing Rules
  • ANSSI-HYG-11 Protect Passwords Stored on Systems
  • ANSSI-HYG-12 Change Default Authentication Elements on Equipment and Services

Azure Security Benchmark · 3 controls

  • ASBv3-DP-6 Use a secure key management process
  • ASBv3-IM-8 Restrict the exposure of credential and secrets
  • IM-3 Manage application identities securely and automatically

C5 (Germany) · 3 controls

  • C5-IDM-08 Confidentiality of authentication information
  • C5-IDM-09 Authentication mechanisms
  • C5-PSS-07 Confidentiality of Authentication Information

CIS Controls v8 · 3 controls

  • CIS-4.7 Manage Default Accounts on Enterprise Assets and Software
  • CIS-5.2 Use Unique Passwords
  • CIS-6.6 Establish and Maintain an Inventory of Authentication and Authorization Systems

ISO 27001:2022 · 3 controls

  • 5.16 Identity management
  • 5.17 Authentication information
  • 8.5 Secure authentication

ISO 27002:2022 · 3 controls

  • 5.16 Identity management
  • 5.17 Authentication information
  • 8.5 Secure authentication

SOC 2 · 3 controls

  • SOC2-CC6.1 Implements logical access security software, infrastructure and architectures over protected information assets
  • SOC2-CC6.2 Prior to granting access, registration and authorization processes are established
  • SOC2-CC6.3 Role-based access and least privilege are enforced

UK Cyber Essentials · 3 controls

  • CE-FW.2 Change Default Firewall Passwords
  • CE-SC.2 Change Default Passwords on Devices and Software
  • CE-SC.8 Process for Compromised Passwords

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-21 Disable local administrator accounts (Excellent)
  • ASD37-23 Protect authentication credentials (Excellent)

AWS Well-Architected Security Pillar · 2 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

HIPAA Security Rule · 2 controls

NIST Cybersecurity Framework 2.0 · 2 controls

  • NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization
  • NIST-CSF-PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions

NIST SP 800-66 Rev 2 · 2 controls

ACSC Essential Eight · 1 control

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment

Australia My Health Records Act 2012 · 1 control

  • MYHR-SEC-2 Access controls and user account management

CMMC 2.0 · 1 control

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-172 · 1 control

NIST SP 800-53 Rev 5 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in IA Identification and Authentication

Query this from an agent

The graph holds this control, the 52 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-53 Rev 5 LOW controls