IA-5 Authenticator management
Requires authenticators to be managed end to end: identity verified before issue, initial content set, strength appropriate to use, administrative procedures for distribution, loss, compromise and revocation, default aut
5
artefacts
1
held by a system
2
at each review
hard
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration enforcing the defined lifetimes and reuse restrictions · Identity provider / directory
periodic reviewEvidence produced at each review
- Evidence default credentials are changed before a component enters service · Identity provider / directory
- Evidence of protected storage such as hashing, vaulting or hardware tokens · Identity provider / directory
governing documentDocuments that govern the control
- Authenticator standard covering strength, lifetime and reuse conditions per authenticator type · Policy repository / GRC workspace
- Procedures for issue, replacement of lost or compromised authenticators and revocation · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Identity provider / directory on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Default credentials remain on appliances, embedded devices and management interfaces
- Service account secrets never rotated because nothing tracks where they are used
- Authenticators emailed or shared in chat during issue and reset
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet