id: "IA-04(08)" title: "Pairwise Pseudonymous Identifiers" family: "IA" family_name: "Identification and Authentication" sort_id: "ia-04.08" priority: "P1" implementation_level: "organization" parent: "IA-04" enhancement: True
Statement
Generate pairwise pseudonymous identifiers.
Guidance
A pairwise pseudonymous identifier is an opaque unguessable subscriber identifier generated by an identity provider for use at a specific individual relying party. Generating distinct pairwise pseudonymous identifiers with no identifying information about a subscriber discourages subscriber activity tracking and profiling beyond the operational requirements established by an organization. The pairwise pseudonymous identifiers are unique to each relying party except in situations where relying parties can show a demonstrable relationship justifying an operational need for correlation, or all parties consent to being correlated in such a manner.
Assessment Objective
pairwise pseudonymous identifiers are generated.
Identification and authentication policy
system security plan
procedures addressing identifier management
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records
Organizational personnel with identifier management responsibilities
organizational personnel with information security responsibilities
Mechanisms supporting and/or implementing identifier management