Device Identification and Authentication IA-3
Identification and Authentication · Moderate baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds IA-3 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Identification and Authentication family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
IA-3 (Device Identification and Authentication) makes the machine prove who it is before it is allowed to connect — not just the person using it. Instead of trusting any device that reaches the network, the system checks the device’s identity first, often with a certificate or a known hardware address. It enters at the Moderate baseline.
What good looks like
- Identify each device allowed to connect and give it a unique identity — a client certificate is stronger than a MAC (Media Access Control) address, which can be spoofed.
- Authenticate the device before the connection is established, for local, remote, or network links as your policy requires.
- Use 802.1X (a network port authentication standard) or mutual TLS (Transport Layer Security) so both ends prove identity, not just the user.
- Bind the device identity to something hard to forge — a certificate held by the device, not a name it simply claims.
- Keep an inventory of authorized devices so you can tell an approved machine from an unknown one.
Framework mapping
- NIST CSF 2.0 — PR.AA-03 — Users, services, and hardware are authenticated
How to move it toward Implemented
- Stand up device authentication for connections into the server — for SSH (Secure Shell), require a host key or a client certificate, and consider mutual TLS for services that accept device connections.
- If the server sits on a managed network, enable 802.1X port authentication so a device must present a certificate before it gets a network connection.
- Record the approved device identifiers (host keys or certificate fingerprints) in a dated inventory file so unknown devices stand out.
- Attach that configuration and inventory as hardening evidence on the asset, naming
IA-3in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.