IA-9 Service Identification and Authentication. Uniquely identify and authenticate [organization-defined] before establishing communications with devices, users, or other services or applications
Service Identification and Authentication. Uniquely identify and authenticate [organization-defined] before establishing communications with devices, users, or other services or applications.
5
artefacts
2
held by a system
1
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration showing authentication occurs before communications are established, not after · Identity provider / directory
- Logs of service to service authentication including failures · Identity provider / directory
periodic reviewEvidence produced at each review
- The mechanism binding an identity to each service, such as certificates, signed tokens or mutual TLS · Identity provider / directory
governing documentDocuments that govern the control
- Definition of the system services and applications required to be identified and authenticated · Policy repository / GRC workspace
- Inventory of service credentials with owner, issuance and rotation dates · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Network location used as the identity, so anything on the segment is trusted implicitly
- Service credentials embedded in code or images with no rotation and no owner
- Authentication one way only, so the client verifies the server while the server accepts any caller
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetIA-8 Identification and authentication of non-organizational users · IA-10 Adaptive Authentication. Require individuals accessing the system to employ [organization-defined] under specific [organization-defined]