---

id: "IA-05" title: "Authenticator Management" family: "IA" family_name: "Identification and Authentication" sort_id: "ia-05" priority: "P1" implementation_level: "system" enhancements: - ia-5.1 - ia-5.2 - ia-5.3 - ia-5.4 - ia-5.5 - ia-5.6 - ia-5.7 - ia-5.8 - ia-5.9 - ia-5.10 - ia-5.11 - ia-5.12 - ia-5.13 - ia-5.14 - ia-5.15 - ia-5.16 - ia-5.17 - ia-5.18

---

Statement

Manage system authenticators by:

Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator;

Establishing initial authenticator content for any authenticators issued by the organization;

Ensuring that authenticators have sufficient strength of mechanism for their intended use;

Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators;

Changing default authenticators prior to first use;

Changing or refreshing authenticators {{ insert: param, ia-05_odp.01 }} or when {{ insert: param, ia-05_odp.02 }} occur;

Protecting authenticator content from unauthorized disclosure and modification;

Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and

Changing authenticators for group or role accounts when membership to those accounts changes.

Guidance

Authenticators include passwords, cryptographic devices, biometrics, certificates, one-time password devices, and ID badges. Device authenticators include certificates and passwords. Initial authenticator content is the actual content of the authenticator (e.g., the initial password). In contrast, the requirements for authenticator content contain specific criteria or characteristics (e.g., minimum password length). Developers may deliver system components with factory default authentication credentials (i.e., passwords) to allow for initial installation and configuration. Default authentication credentials are often well known, easily discoverable, and present a significant risk. The requirement to protect individual authenticators may be implemented via control PL-4 or PS-6 for authenticators in the possession of individuals and by controls AC-3, AC-6 , and SC-28 for authenticators stored in organizational systems, including passwords stored in hashed or encrypted formats or files containing encrypted or hashed passwords accessible with administrator privileges.

Systems support authenticator management by organization-defined settings and restrictions for various authenticator characteristics (e.g., minimum password length, validation time window for time synchronous one-time tokens, and number of allowed rejections during the verification stage of biometric authentication). Actions can be taken to safeguard individual authenticators, including maintaining possession of authenticators, not sharing authenticators with others, and immediately reporting lost, stolen, or compromised authenticators. Authenticator management includes issuing and revoking authenticators for temporary access when no longer needed.

Assessment Objective: system authenticators are managed through the verification of the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution;

Assessment Objective: system authenticators are managed through the establishment of initial authenticator content for any authenticators issued by the organization;

Assessment Objective: system authenticators are managed to ensure that authenticators have sufficient strength of mechanism for their intended use;

Assessment Objective: system authenticators are managed through the establishment and implementation of administrative procedures for initial authenticator distribution; lost, compromised, or damaged authenticators; and the revocation of authenticators;

Assessment Objective: system authenticators are managed through the change of default authenticators prior to first use;

Assessment Objective: system authenticators are managed through the change or refreshment of authenticators {{ insert: param, ia-05_odp.01 }} or when {{ insert: param, ia-05_odp.02 }} occur;

Assessment Objective: system authenticators are managed through the protection of authenticator content from unauthorized disclosure and modification;

Assessment Objective: system authenticators are managed through the requirement for individuals to take specific controls to protect authenticators;

Assessment Objective: system authenticators are managed through the requirement for devices to implement specific controls to protect authenticators;

Assessment Objective: system authenticators are managed through the change of authenticators for group or role accounts when membership to those accounts changes.

Identification and authentication policy

system security plan

addressing authenticator management

system design documentation

system configuration settings and associated documentation

list of system authenticator types

change control records associated with managing system authenticators

system audit records

other relevant documents or records

Organizational personnel with authenticator management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Mechanisms supporting and/or implementing authenticator management capability