{"data":{"id":"IA-05","name":"Authenticator Management","family":"IA","family_name":"Identification and Authentication","withdrawn":false,"description":"Manage system authenticators by:\na. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator;\nb. Establishing initial authenticator content for any authenticators issued by the organization;\nc. Ensuring that authenticators have sufficient strength of mechanism for their intended use;\nd. Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators;\ne. Changing default authenticators prior to first use;\nf. Changing or refreshing authenticators [Assignment: organization-defined time period by authenticator type] or when [Assignment: organization-defined events] occur;\ng. Protecting authenticator content from unauthorized disclosure and modification;\nh. Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and\ni. Changing authenticators for group or role accounts when membership to those accounts changes.","supplemental_guidance":"Authenticators include passwords, cryptographic devices, biometrics, certificates, one-time password devices, and ID badges. Device authenticators include certificates and passwords. Initial authenticator content is the actual content of the authenticator (e.g., the initial password). In contrast, the requirements for authenticator content contain specific criteria or characteristics (e.g., minimum password length). Developers may deliver system components with factory default authentication credentials (i.e., passwords) to allow for initial installation and configuration. Default authentication credentials are often well known, easily discoverable, and present a significant risk. The requirement to protect individual authenticators may be implemented via control PL-04 or PS-06 for authenticators in the possession of individuals and by controls AC-03, AC-06, and SC-28 for authenticators stored in organizational systems, including passwords stored in hashed or encrypted formats or files containing encrypted or hashed passwords accessible with administrator privileges.\n\nSystems support authenticator management by organization-defined settings and restrictions for various authenticator characteristics (e.g., minimum password length, validation time window for time synchronous one-time tokens, and number of allowed rejections during the verification stage of biometric authentication). Actions can be taken to safeguard individual authenticators, including maintaining possession of authenticators, not sharing authenticators with others, and immediately reporting lost, stolen, or compromised authenticators. Authenticator management includes issuing and revoking authenticators for temporary access when no longer needed.","enhancements":[{"id":"IA-05(01)","name":"Password-based Authentication","statement":"For password-based authentication:\na. Maintain a list of commonly-used, expected, or compromised passwords and update the list [Assignment: organization-defined frequency] and when organizational passwords are suspected to have been compromised directly or indirectly;\nb. Verify, when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5(1)(a);\nc. Transmit passwords only over cryptographically-protected channels;\nd. Store passwords using an approved salted key derivation function, preferably using a keyed hash;\ne. Require immediate selection of a new password upon account recovery;\nf. Allow user selection of long passwords and passphrases, including spaces and all printable characters;\ng. Employ automated tools to assist the user in selecting strong password authenticators; and\nh. Enforce the following composition and complexity rules: [Assignment: organization-defined composition and complexity rules].","baselines":["low","moderate","high"]},{"id":"IA-05(02)","name":"Public Key-based Authentication","statement":"a. For public key-based authentication:\n1. Enforce authorized access to the corresponding private key; and\n2. Map the authenticated identity to the account of the individual or group; and\nb. When public key infrastructure (PKI) is used:\n1. Validate certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information; and\n2. Implement a local cache of revocation data to support path discovery and validation.","baselines":["moderate","high"]},{"id":"IA-05(03)","name":"In-person or Trusted External Party Registration","withdrawn":true,"incorporated_into":["IA-12(04)"]},{"id":"IA-05(04)","name":"Automated Support for Password Strength Determination","withdrawn":true,"incorporated_into":["IA-05(01)"]},{"id":"IA-05(05)","name":"Change Authenticators Prior to Delivery","statement":"Require developers and installers of system components to provide unique authenticators or change default authenticators prior to delivery and installation.","baselines":[]},{"id":"IA-05(06)","name":"Protection of Authenticators","statement":"Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.","baselines":["moderate","high"]},{"id":"IA-05(07)","name":"No Embedded Unencrypted Static Authenticators","statement":"Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage.","baselines":[]},{"id":"IA-05(08)","name":"Multiple System Accounts","statement":"Implement [Assignment: organization-defined security controls] to manage the risk of compromise due to individuals having accounts on multiple systems.","baselines":[]},{"id":"IA-05(09)","name":"Federated Credential Management","statement":"Use the following external organizations to federate credentials: [Assignment: organization-defined external organizations].","baselines":[]},{"id":"IA-05(10)","name":"Dynamic Credential Binding","statement":"Bind identities and authenticators dynamically using the following rules: [Assignment: organization-defined binding rules].","baselines":[]},{"id":"IA-05(11)","name":"Hardware Token-based Authentication","withdrawn":true,"incorporated_into":["IA-02(01)","IA-02(02)"]},{"id":"IA-05(12)","name":"Biometric Authentication Performance","statement":"For biometric-based authentication, employ mechanisms that satisfy the following biometric quality requirements [Assignment: organization-defined biometric quality requirements].","baselines":[]},{"id":"IA-05(13)","name":"Expiration of Cached Authenticators","statement":"Prohibit the use of cached authenticators after [Assignment: organization-defined time period].","baselines":[]},{"id":"IA-05(14)","name":"Managing Content of PKI Trust Stores","statement":"For PKI-based authentication, employ an organization-wide methodology for managing the content of PKI trust stores installed across all platforms, including networks, operating systems, browsers, and applications.","baselines":[]},{"id":"IA-05(15)","name":"GSA-approved Products and Services","statement":"Use only General Services Administration-approved products and services for identity, credential, and access management.","baselines":[]},{"id":"IA-05(16)","name":"In-person or Trusted External Party Authenticator Issuance","statement":"Require that the issuance of [Assignment: organization-defined types of and/or specific authenticators] be conducted [Selection (one): in person; by a trusted external party] before [Assignment: organization-defined registration authority] with authorization by [Assignment: organization-defined personnel or roles].","baselines":[]},{"id":"IA-05(17)","name":"Presentation Attack Detection for Biometric Authenticators","statement":"Employ presentation attack detection mechanisms for biometric-based authentication.","baselines":[]},{"id":"IA-05(18)","name":"Password Managers","statement":"a. Employ [Assignment: organization-defined password managers] to generate and manage passwords; and\nb. Protect the passwords using [Assignment: organization-defined controls].","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"IA-05","name":"Authenticator Management","description":"Manage system authenticators by:\na. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator;\nb. Establishing initial authenticator content for any authenticators issued by the organization;\nc. Ensuring that authenticators have sufficient strength of mechanism for their intended use;\nd. Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators;\ne. Changing default authenticators prior to first use;\nf. Changing or refreshing authenticators [Assignment: organization-defined time period by authenticator type] or when [Assignment: organization-defined events] occur;\ng. Protecting authenticator content from unauthorized disclosure and modification;\nh. Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and\ni. Changing authenticators for group or role accounts when membership to those accounts changes.","discussion":"Authenticators include passwords, cryptographic devices, biometrics, certificates, one-time password devices, and ID badges. Device authenticators include certificates and passwords. Initial authenticator content is the actual content of the authenticator (e.g., the initial password). In contrast, the requirements for authenticator content contain specific criteria or characteristics (e.g., minimum password length). Developers may deliver system components with factory default authentication credentials (i.e., passwords) to allow for initial installation and configuration. Default authentication credentials are often well known, easily discoverable, and present a significant risk. The requirement to protect individual authenticators may be implemented via control PL-04 or PS-06 for authenticators in the possession of individuals and by controls AC-03, AC-06, and SC-28 for authenticators stored in organizational systems, including passwords stored in hashed or encrypted formats or files containing encrypted or hashed passwords accessible with administrator privileges.\n\nSystems support authenticator management by organization-defined settings and restrictions for various authenticator characteristics (e.g., minimum password length, validation time window for time synchronous one-time tokens, and number of allowed rejections during the verification stage of biometric authentication). Actions can be taken to safeguard individual authenticators, including maintaining possession of authenticators, not sharing authenticators with others, and immediately reporting lost, stolen, or compromised authenticators. Authenticator management includes issuing and revoking authenticators for temporary access when no longer needed.","related_controls":["AC-03","AC-06","CM-06","IA-02","IA-04","IA-07","IA-08","IA-09","MA-04","PE-02","PL-04","SC-12","SC-13"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Removes requirement to change default content of authenticators prior to information system installation New parameter requires specifying events that require changing or refreshing authenticators Changes 'security safeguards' to 'controls' Discussion includes new examples"}},"compliance_mappings":{"iso_27001_2022":["A.5.16","A.5.17","A.8.5"],"iso_27002_2022":["5.16","5.17","8.5"],"cobit_2019":["DSS05"],"pci_dss_v4":["2.2.1","2.2.2","8.2","8.3","8.3.6","8.3.9","8.6"],"nist_csf_2":["PR.AA-01","PR.AA-02","PR.AA-03","PR.AA-04"],"cis_controls_v8":["CIS 4.7","CIS 5","CIS 5.2","CIS 14.3"],"soc2_tsc":["CC6.1"],"finos_ccc":["CCC-C11"],"iso_42001_2023":[],"iec_62443":["3-3 SR 1.1","3-3 SR 1.5","3-3 SR 1.7"],"asd_e8":["E8-5 ML3","E8-7"],"nis2":[],"apra_cps_234":[],"mas_trm":["9"],"pra_op_resilience":[],"bsi_grundschutz":["ORP.4"],"anssi":["Hygiene.10","Hygiene.12","RGS.2.2","SecNumCloud.10.5"],"osfi_b13":["B-13.3.2"],"finma_circular":["IV.B.d(59)","IV.B.d(60)","IV.C(61)"],"gdpr":["Art.32(1)(a)","Art.32(1)(b)"],"dora":["Art.9(3)","Art.9(4)(c)","Art.9(4)(d)"],"bio2":["5.16","5.17","8.5"],"rbi_csf":["Annex1.8","Annex1.9","ITGRCA.19"],"fisc":["FISC.T2","FISC.T10"],"lgpd_bcb":["BCB.Art.3","BCB.OpenFinance","BCB.PIX","LGPD.Art.46"],"hkma_tme1":["TME1.8.2","TME1.8.3","TME1.10.4"],"mlps_2":["8.1.4.1","8.1.10.7"],"dnb_good_practice":["DNB.17.1","DNB.17.2"],"cra":["CRA.I.2d"],"swift_cscf":["SWIFT.4.1","SWIFT.4.2","SWIFT.5.2","SWIFT.5.4"],"cbb_tm":["TM-6"],"cbuae":["CR-4"],"nca_ecc":["2-2"],"qatar_nia":["AC"],"sama_csf":["3.1"],"uae_ia":["T9"],"bog_cisd":["CISD-IX","CISD-VIII"],"bom_ctrm":["3.3"],"cbe_csf":["CTO-1","CTO-5"],"cbn_csf":["Part3.2"],"popia":["s19"],"sa_js2":["JS2-7.1","JS2-8.1"],"bot_cyber":["Ch2.2"],"cpmi_pfmi":["CG.PR","PFMI.P17"],"eba_ict":["3.4.2","3.8(b)"],"ecb_croe":["CROE.2.3.1"],"ffiec_is":["II.C.7(b)","II.C.15","II.C.15(a)"],"hipaa_sr":["§164.308(a)(4)(ii)(C)","§164.308(a)(5)(ii)(D)","§164.312(d)"],"iosco_cyber":["PROT-1"],"nydfs_500":["500.7","500.12"],"sebi_cscrf":["PR.AA"],"cmmc_2":["AC","IA"],"nerc_cip":["CIP-005-7","CIP-006-6","CIP-007-6","CIP-011-3"],"nrc_73_54":["RG5.71-A-AC"],"tsa_psd":["SD-2 Sec B"],"ieee_1686":["5.1","5.7"],"ferc_cip":[],"doe_c2m2":["ACCESS"],"api_1164":["Sec 6"],"awia":["AWWA Sec 3"],"iaea_nss":["Sec 5.2"],"pci_pts":[],"fips_140":["FIPS 140-3 §7.4","FIPS 140-3 §7.9"],"cbest":[],"tiber_eu":[],"pci_hsm":["9"],"common_criteria":["CC Part 2 — FIA"],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.7.3"],"fda_21_cfr_11":["§11.10(d)","§11.100(a)","§11.100(b)","§11.200(a)(1)","§11.200(a)(1)(ii)","§11.200(a)(2)","§11.300(a)","§11.300(b)","§11.300(c)","§11.300(e)"],"fda_cyber":["SA-1"],"hitrust_csf":["01.a","01.c"],"iso_27799":["9.3","9.4"],"lloyds_ms":["MS8.3"],"naic_ds":["4-access","4B"],"nhs_dspt":["NDG-4.1","NDG-4.2","NDG-4.3"],"pra_ss1_23":["P-IT.1"],"solvency_ii":["EIOPA-ICT-4.4"],"owasp_masvs_v2":["MASVS-AUTH-1","MASVS-AUTH-2","MASVS-NETWORK-2"],"csa_ccm_v4":["IAM-02","IAM-06","IAM-14","IAM-15"],"csa_aicm":["IAM-02","IAM-06","IAM-14","IAM-15"],"ccss_v9":["1.04.1","1.04.2","1.06.2"],"mica":["Art.40(1)","Art.55(1)","Art.63(1)","Art.67(1)","Art.76(1)"],"basel_sco60":["SCO60.61","SCO60.62","SCO60.66"],"bssc":["GSP-11","KMS-06","KMS-07","KMS-08","NOS-05","NOS-08"],"sec_custody_digital":["SEC-CD-02","SEC-CD-03","SEC-CD-05","SEC-CD-06","SEC-CD-07","SEC-CD-16"],"dpdpa":["Rules.6(1)(b)"],"nist_ai_rmf_1":[],"eu_ai_act":[]},"metadata":{"last_reviewed":"2026-10-26","review_notes":"2026-10-03: nist_csf_2 PR.AA-03 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-26: nerc_cip CIP-005-7, CIP-006-6, CIP-011-3 added from NIST and NERC's SP 800-53 Rev 5.2.0 to NERC CIP crosswalk (OLIR entry 232), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-011","SP-012","SP-015","SP-022","SP-027","SP-028","SP-029","SP-030","SP-031","SP-032","SP-033","SP-034","SP-037","SP-039","SP-040","SP-041","SP-044","SP-047","SP-050","SP-052","SP-054"],"attack":{"techniques":72,"route":"/api/v1/controls/IA-05?fields=attack"}}}