Authenticator Management IA-5

Identification and Authentication · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds IA-5 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Identification and Authentication family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

IA-5 (Authenticator Management) is about managing the secrets that prove identity - passwords, SSH (Secure Shell) keys, certificates, tokens - across their whole life: verifying identity before issuing one, setting its strength, protecting it, rotating it, and revoking it when it is no longer needed. Moderate baseline.

What good looks like

Verify the identity of the recipient before issuing an authenticator.
Set and enforce strength - length, complexity, or key type - for each authenticator.
Protect authenticators from disclosure and change any vendor or default credentials.
Rotate and revoke authenticators on a schedule and when a person leaves or a secret is compromised, and never share them.

Framework mapping

NIST CSF 2.0 — PR.AA-01 — Identities and credentials for authorized users are issued and managed
CIS Controls v8 — Control 5 — Account Management - manage credentials through their lifecycle

How to move it toward Implemented

This is met on VM 607: a dedicated BLUEADMIN identity replaces the shared root credential (§1a), an SSH public-key authenticator was installed via ssh-copy-id (§1b), key-only auth with passwords disabled is enforced in 00-hardening.conf (§1c), and libpam-pwquality enforces strength on the remaining sudo password (§1g) - with no shared or default accounts left.
Keep it met by adding the lifecycle piece the note lacks: rotate and retire the SSH key on a defined schedule and on any personnel change, and protect the private key at rest on the admin's Mac.
Attach the sshd hardening file, the ssh-copy-id record, and the pwquality config as asset-scoped evidence naming IA-5 in the Requirement field to reach 'Completed'.