• Identification Policy and Procedures: Organizations should develop and implement an identification policy that defines the requirements and procedures for establishing and managing user and system identities. Procedures should be established to guide personnel on identity registration, issuance, and management.
• User Identification and Authentication: Organizations should implement mechanisms to uniquely identify users and authenticate their identities before granting access to information systems. This includes using unique usernames or user IDs, as well as passwords, Personal Identification Numbers (PINs), or other credentials to verify user identities. Stronger forms of authentication, such as multi-factor authentication (MFA), should be used for higher-risk systems or sensitive information.
• Device Identification and Authentication: Information systems should employ mechanisms to identify and authenticate devices, such as computers, servers, and mobile devices, before granting access. This can involve using device certificates, MAC addresses, or other unique identifiers to ensure only authorized and trusted devices can connect to the system.
• Remote Authentication: For remote access scenarios, organizations should implement secure authentication mechanisms to verify the identities of users connecting from outside the organization's physical boundaries. This can involve virtual private networks (VPNs), secure tokens, or other secure remote authentication protocols.
• Password Management: Organizations should establish password policies that define the requirements for password complexity, length, expiration, and other relevant parameters. Passwords should be stored securely, transmitted securely, and protected against unauthorized access or disclosure.
• Biometric Authentication: Organizations can employ biometric authentication methods, such as fingerprint scanning, iris recognition, or facial recognition, to enhance the strength of authentication. Biometric data should be protected and stored securely to maintain privacy and prevent unauthorized access.
• Account Lockout: Organizations should implement account lockout mechanisms to prevent brute-force attacks or unauthorized access attempts. Account lockout policies can temporarily or permanently lock user accounts after a specified number of failed login attempts.
• Single Sign-On (SSO): SSO solutions can simplify the authentication process for users by allowing them to access multiple systems or applications with a single set of credentials. However, it is important to ensure that SSO implementations adhere to strong security controls to prevent unauthorized access to multiple systems if one credential is compromised.

By implementing strong identification and authentication controls, organizations can mitigate the risk of unauthorized access, data breaches, and identity-related attacks. It is essential to assess the unique needs and risks of the organization and tailor the controls accordingly. Regular monitoring, updates, and user awareness about secure authentication practices are also crucial for maintaining a secure authentication environment.

100 + NIST 800-53 Templates Available for Download for Federal Contractors

The solution for federal contractors is the Arlington Security Portal (ASP), an online repository of world-class, industry leading security and privacy policies & procedures, programs, plans – and other highly essential documents & templates developed specifically on NIST SP 800-53, Revision 5.

From Beginning to End, Complete Project Management for NIST RMF

With Arlington, we can manage your entire NIST RMF A&A process from beginning to end (i.e., from the initial scoping & gap assessment to post-Authorization to Operate (ATO) activities), providing essential services for getting you to the finish line in terms of your ATO.  Core services and solutions offered include the following:

• Scoping & Gap (i.e., Readiness) Assessments
• Remediation Services (Policy and Procedures writing)
• Remediation Services (Technical and Operational)
• System Security Plan (SSP) Development
• Security Assessment Reports (SAR)
• Continuous Monitoring (ConMon) Services

About Arlington

We are Arlington, a team of innovative, solution-oriented, highly agile, and well-versed professionals with decades of experience in working with America’s defense industry. From emerging cybersecurity regulations to helping our clients solve complex security & compliance solutions – and so much more – you can trust Arlington, the firm that’s Dedicated to Defense®.  Learn more at arlingtonintel.com