800-53|IA-4

Title

IDENTIFIER MANAGEMENT

Description

The organization manages information system identifiers by:

Supplemental

Common device identifiers include, for example, media access control (MAC), Internet protocol (IP) addresses, or device-unique token identifiers. Management of individual identifiers is not applicable to shared information system accounts (e.g., guest and anonymous accounts). Typically, individual identifiers are the user names of the information system accounts assigned to those individuals. In such instances, the account management activities of AC-2 use account names provided by IA-4. This control also addresses individual identifiers not necessarily associated with information system accounts (e.g., identifiers used in physical security control databases accessed by badge reader systems for access to information systems). Preventing reuse of identifiers implies preventing the assignment of previously used individual, group, role, or device identifiers to different individuals, groups, roles, or devices.

Reference Item Details

Related: AC-2,IA-2,IA-3,IA-5,IA-8,SC-37

Category: IDENTIFICATION AND AUTHENTICATION

Family: IDENTIFICATION AND AUTHENTICATION

Priority: P1

Baseline Impact: LOW,MODERATE,HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1.2 Ensure only trusted users are allowed to control Docker daemonUnixCIS Docker v1.6.0 L1 Docker Linux
1.1.3.17.7 Set 'User Account Control: Switch to the secure desktop when prompting for elevation' to 'Enabled'WindowsCIS Windows 8 L1 v1.0.0
1.11 Ensure 'User consent for applications' is set to 'Do not allow user consent'microsoft_azureCIS Microsoft Azure Foundations v2.0.0 L1
1.12 Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers'microsoft_azureCIS Microsoft Azure Foundations v2.0.0 L2
1.16 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users'microsoft_azureCIS Microsoft Azure Foundations v2.0.0 L2
1.25 Ensure That 'Subscription Entering AAD Directory' and 'Subscription Leaving AAD Directory' Is Set To 'Permit No One'microsoft_azureCIS Microsoft Azure Foundations v2.0.0 L2
2.3.17.7 Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled'WindowsCIS Microsoft Intune for Windows 11 v2.0.0 L1 + BL
2.3.17.7 Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled'WindowsCIS Microsoft Intune for Windows 10 v2.0.0 L1 + NG
2.3.17.7 Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled'WindowsCIS Microsoft Intune for Windows 10 v2.0.0 L1 + BL + NG
2.3.17.7 Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled'WindowsCIS Microsoft Intune for Windows 10 v2.0.0 L1 + BL
2.3.17.7 Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled'WindowsCIS Microsoft Intune for Windows 11 v2.0.0 L1
2.3.17.7 Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled'WindowsCIS Microsoft Intune for Windows 11 v2.0.0 L1 + BL + NG
2.3.17.7 Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled'WindowsCIS Microsoft Intune for Windows 10 v2.0.0 L1
2.3.17.7 Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled'WindowsCIS Microsoft Intune for Windows 11 v2.0.0 L1 + NG
2.7 Ensure that a unique Certificate Authority is used for etcdUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L2 Master
2.7 Ensure that a unique Certificate Authority is used for etcdUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L2 Master
2.7 Ensure that a unique Certificate Authority is used for etcdUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L2 Master
2.7 Ensure that a unique Certificate Authority is used for etcdUnixCIS Kubernetes Benchmark v1.8.0 L2 Master
2.14 Ensure containers are restricted from acquiring new privilegesUnixCIS Docker v1.6.0 L1 Docker Linux
5.1.6.1 Ensure that collaboration invitations are sent to allowed domains onlymicrosoft_azureCIS Microsoft 365 Foundations E3 L2 v3.0.0
5.3.1 Ensure 'Privileged Identity Management' is used to manage rolesmicrosoft_azureCIS Microsoft 365 Foundations E5 L2 v3.0.0
5.3.2 Ensure system accounts are secured - lock not rootUnixCIS Google Container-Optimized OS L2 Server v1.1.0
5.3.2 Ensure system accounts are secured - non loginUnixCIS Google Container-Optimized OS L2 Server v1.1.0
5.10 Set DCUI.Access to allow trusted users to override lockdown modeVMwareCIS VMware ESXi 6.5 v1.0.0 Level 1
6.2.3 Ensure all groups in /etc/passwd exist in /etc/groupUnixCIS Ubuntu Linux 16.04 LTS Server L1 v2.0.0
6.2.3 Ensure all groups in /etc/passwd exist in /etc/groupUnixCIS Ubuntu Linux 16.04 LTS Workstation L1 v2.0.0
6.2.12 Ensure all groups in /etc/passwd exist in /etc/groupUnixCIS Debian Family Server L1 v1.0.0
6.2.12 Ensure all groups in /etc/passwd exist in /etc/groupUnixCIS Debian Family Workstation L1 v1.0.0
6.2.15 Ensure all groups in /etc/passwd exist in /etc/groupUnixCIS Ubuntu Linux 18.04 LXD Host L1 Server v1.0.0
6.2.15 Ensure all groups in /etc/passwd exist in /etc/groupUnixCIS Ubuntu Linux 18.04 LXD Host L1 Workstation v1.0.0
6.2.15 Ensure all groups in /etc/passwd exist in /etc/groupUnixCIS Ubuntu Linux 18.04 LXD Container L1 v1.0.0
7.1 Ensure authentication file permissions are set correctlyWindowsCIS MongoDB 3.6 L1 Windows Audit v1.1.0
7.1 Ensure authentication file permissions are set correctlyUnixCIS MongoDB 3.6 L1 Unix Audit v1.1.0
9.2 Check for Duplicate User NamesUnixCIS Oracle Solaris 11.4 L1 v1.0.0
9.13 Check Groups in passwdUnixCIS Oracle Solaris 11.4 L1 v1.0.0
17.2.2 (L1) Ensure 'Audit Security Group Management' is set to include 'Success'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker
17.2.2 Ensure 'Audit Security Group Management' is set to include 'Success'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1
17.2.3 (L1) Ensure 'Audit User Account Management' is set to 'Success and Failure'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker
17.2.3 Ensure 'Audit User Account Management' is set to 'Success and Failure'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1
17.5.1 (L1) Ensure 'Audit Account Lockout' is set to include 'Failure'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker
17.5.1 Ensure 'Audit Account Lockout' is set to include 'Failure'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1
17.5.2 (L1) Ensure 'Audit Logoff' is set to include 'Success'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker
17.5.2 Ensure 'Audit Logoff' is set to include 'Success'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1
17.5.3 (L1) Ensure 'Audit Logon' is set to 'Success and Failure'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker
17.5.3 Ensure 'Audit Logon' is set to 'Success and Failure'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1
17.5.4 (L1) Ensure 'Audit Other Logon/Logoff Events' is set to 'Success and Failure'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker
17.5.4 Ensure 'Audit Other Logon/Logoff Events' is set to 'Success and Failure'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1
17.5.5 (L1) Ensure 'Audit Special Logon' is set to include 'Success'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker
17.5.5 Ensure 'Audit Special Logon' is set to include 'Success'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1
BSI-100-2: S 4.13: Careful allocation of identifiers: /etc/group consistencyUnixBSI-100-2 Red Hat Linux 2005