id: "IA-12" title: "Identity Proofing" family: "IA" family_name: "Identification and Authentication" sort_id: "ia-12" priority: "P1" implementation_level: "organization" enhancements: - ia-12.1 - ia-12.2 - ia-12.3 - ia-12.4 - ia-12.5 - ia-12.6
Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines;
Resolve user identities to a unique individual; and
Collect, validate, and verify identity evidence.
Guidance
Identity proofing is the process of collecting, validating, and verifying a user’s identity information for the purposes of establishing credentials for accessing a system. Identity proofing is intended to mitigate threats to the registration of users and the establishment of their accounts. Standards and guidelines specifying identity assurance levels for identity proofing include SP 800-63-3 and SP 800-63A . Organizations may be subject to laws, executive orders, directives, regulations, or policies that address the collection of identity evidence. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.
Assessment Objective: users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity proofed;
Assessment Objective: user identities are resolved to a unique individual;
Assessment Objective: identity evidence is collected;
Assessment Objective: identity evidence is validated;
Assessment Objective: identity evidence is verified.
Identification and authentication policy
procedures addressing identity proofing
system security plan
privacy plan
other relevant documents or records
Organizational personnel with system operations responsibilities
organizational personnel with information security and privacy responsibilities
legal counsel
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
Mechanisms supporting and/or implementing identification and authentication capabilities