Identity Proofing IA-12
Identification and Authentication · Moderate baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds IA-12 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Identification and Authentication family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
IA-12 (Identity Proofing) is about confirming a person really is who they claim to be before they get an account — not just issuing credentials on request. You check real-world identity evidence, tie the account to one unique individual, and record how strong that check was. It is an Identification and Authentication control that enters at the Moderate baseline and continues into High.
What good looks like
- Set the identity assurance level you require — how certain you need to be of someone’s identity — and base it on a recognized standard.
- Collect and check identity evidence (for example, a government-issued photo identification) before the account is created.
- Resolve the person to a unique individual so two people never share one identity and one person is not enrolled twice under different names.
- Validate and verify the evidence — confirm the document is genuine and that it truly belongs to the person presenting it.
- Record the proofing for each account: what evidence was seen, who checked it, and the date — so the account can be traced back to a real, verified person.
Framework mapping
- NIST CSF 2.0 — PR.AA-02 — Identities are proofed and bound to credentials based on the context of interactions
How to move it toward Implemented
- Write a one-page identity-proofing procedure: the identity assurance level required, the evidence you accept, how you confirm it is genuine, and how you tie it to one unique person — referencing NIST SP 800-63A (Digital Identity Guidelines: Enrollment and Identity Proofing) as your standard.
- For every named account on the server, create a proofing record linking the Linux username to the verified real person, the evidence reviewed, the reviewer, and the date.
- Cross-check those records against the live account list (
getent passwd) so no account exists without a matching, proofed identity. - Save the procedure and the completed proofing records together as a dated file.
- Attach that file as hardening evidence on the asset, naming
IA-12in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.