IA-5: Authenticator Management

Statement

• Manage system authenticators by:

  • a.

    Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator;

  • b.

    Establishing initial authenticator content for any authenticators issued by the organization;

  • c.

    Ensuring that authenticators have sufficient strength of mechanism for their intended use;

  • d.

    Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators;

  • e.

    Changing default authenticators prior to first use;

  • f.

    Changing or refreshing authenticators time period by authenticator type or when events occur;

  • g.

    Protecting authenticator content from unauthorized disclosure and modification;

  • h.

    Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and

  • i.

    Changing authenticators for group or role accounts when membership to those accounts changes.