EvidenceSheet

IA-11 Re-Authentication

Require re-authentication when FedRAMP-defined circumstances occur (role change, privilege change, time period elapsed).

6
artefacts
3
held by a system
0
at each review
easy
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review

system holds itEvidence a system already holds

  • MFA enrolment report for all privileged and remote users · Identity provider / directory
  • Password policy configuration export from the identity provider · Identity provider / directory
  • Service account credential vault inventory and rotation logs · Identity provider / directory

periodic reviewEvidence produced at each review

none for this control

governing documentDocuments that govern the control

  • Control implementation statement for IA-11 citing the system mission and inheritance from common controls · Policy repository / GRC workspace
  • Authenticator lifecycle procedure including reset and revocation · Policy repository / GRC workspace
  • Identification and authentication policy · Policy repository / GRC workspace

First move

Automate the pull from your Identity provider / directory. Scheduled export of users, roles and MFA state from the directory; access-review completion pulled from the IdP, not a spreadsheet.

Common gaps auditors find

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

IA-8(4) Identification and Authentication (non-organizational Users) | Use of Defined Profiles. Conform to the following profiles for identity management [Assignment: organization-defined identity management profiles] · IA-12 Identity Proofing. a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines; b. Resolve user identities to a