IA-05 Authenticator Management

For password-based authentication: a. Maintain a list of commonly-used, expected, or compromised passwords and update the list [Assignment: organization-defined frequency] and when organizational passwords are suspected to have been compromised directly or indirectly; b. Verify, when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5(1)(a); c. Transmit passwords only over cryptographically-protected channels; d. Store passwords using an approved salted key derivation function, preferably using a keyed hash; e. Require immediate selection of a new password upon account recovery; f. Allow user selection of long passwords and passphrases, including spaces and all printable characters; g. Employ automated tools to assist the user in selecting strong password authenticators; and h. Enforce the following composition and complexity rules: [Assignment: organization-defined composition and complexity rules].

a. For public key-based authentication: 1. Enforce authorized access to the corresponding private key; and 2. Map the authenticated identity to the account of the individual or group; and b. When public key infrastructure (PKI) is used: 1. Validate certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information; and 2. Implement a local cache of revocation data to support path discovery and validation.

Require developers and installers of system components to provide unique authenticators or change default authenticators prior to delivery and installation.

Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.

Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage.

Implement [Assignment: organization-defined security controls] to manage the risk of compromise due to individuals having accounts on multiple systems.

Use the following external organizations to federate credentials: [Assignment: organization-defined external organizations].

Bind identities and authenticators dynamically using the following rules: [Assignment: organization-defined binding rules].

For biometric-based authentication, employ mechanisms that satisfy the following biometric quality requirements [Assignment: organization-defined biometric quality requirements].

Prohibit the use of cached authenticators after [Assignment: organization-defined time period].

For PKI-based authentication, employ an organization-wide methodology for managing the content of PKI trust stores installed across all platforms, including networks, operating systems, browsers, and applications.

Use only General Services Administration-approved products and services for identity, credential, and access management.

Require that the issuance of [Assignment: organization-defined types of and/or specific authenticators] be conducted [Selection (one): in person; by a trusted external party] before [Assignment: organization-defined registration authority] with authorization by [Assignment: organization-defined personnel or roles].

Employ presentation attack detection mechanisms for biometric-based authentication.

a. Employ [Assignment: organization-defined password managers] to generate and manage passwords; and b. Protect the passwords using [Assignment: organization-defined controls].