IA-03 Device Identification And Authentication

Identification and Authentication

Low Moderate High

Description

The information system identifies and authenticates specific devices before establishing a connection.\n

Supplemental Guidance

The information system typically uses either shared known information (e.g., Media Access Control (MAC) or Transmission Control Protocol/Internet Protocol (TCP/IP) addresses) or an organizational authentication solution (e.g., IEEE 802.1x and Extensible Authentication Protocol (EAP) or a Radius server with EAP-Transport Layer Security (TLS) authentication) to identify and authenticate devices on local and/or wide area networks. The required strength of the device authentication mechanism is determined by the FIPS 199 security categorization of the information system with higher impact levels requiring stronger authentication.\n

Enhancements

(0) None.\n

Compliance Mappings

ISO 27002:2022

5.16

CIS Controls v8

12.5

NIST CSF 2.0

PR.AA-01PR.AA-03PR.AA-05

SOC 2 TSC

CC6.1CC6.1-POF3CC6.1-POF8

ISO 17799 (legacy)

11.4.211.4.311.7.1

COBIT 4.1 (legacy)

None.