Identifier Management IA-4

Identification and Authentication · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds IA-4 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Identification and Authentication family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

IA-4 (Identifier Management) is about controlling the names and numbers that stand for a user, group, role, service, or device — usernames and the UID (User Identifier) numbers behind them. It makes sure each identifier is approved before it is handed out, points to the right subject, and is not recycled to someone else later. It applies from the Low baseline up.

What good looks like

Get approval before assigning an identifier — a username, group, service account, or device name.
Pick an identifier that clearly maps to one individual, group, role, service, or device, with no ambiguity.
Assign it to the intended subject — the right person or system, not a shared placeholder.
Prevent reuse: do not hand an old username or UID to a new person for a defined period, or accounts and logs blur together.
Avoid collisions — two subjects should never share the same UID.

Framework mapping

NIST CSF 2.0 — PR.AA-01 — Identities and credentials for authorized users, services, and hardware are managed by the organization
CIS Controls v8 — Control 6 — Access Control Management

How to move it toward Implemented

Set a UID range policy in /etc/login.defs (UID_MIN / UID_MAX) so human accounts get identifiers from a predictable block, and never manually reuse a freed UID.
When you remove a user, keep the record (for example deluser without immediately recycling the UID) so the old identifier is not reassigned during your defined hold period.
Confirm every identifier maps to one intended subject and there are no duplicate UIDs — check with getent passwd and cut -d: -f3 /etc/passwd | sort | uniq -d.
Attach that identifier review as hardening evidence on the asset, naming IA-4 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.