Overview
  1. 03.01: Access Control
  2. 03.02: Awareness and Training
  3. 03.03: Audit and Accountability
  4. 03.04: Configuration Management
  5. 03.05: Identification and Authentication
  6. 03.06: Incident Response
  7. 03.07: Maintenance
  8. 03.08: Media Protection
  9. 03.09: Personnel Security
  10. 03.10: Physical Protection
  11. 03.11: Risk Assessment
  12. 03.12: Security Assessment and Monitoring
  13. 03.13: System and Communications Protection
  14. 03.14: System and Information Integrity
  15. 03.15: Planning
  16. 03.16: System and Services Acquisition
  17. 03.17: Supply Chain Risk Management

Security Requirements for 03.05.05 Identifier Management

Identifiers are provided for users, processes acting on behalf of users, and devices. Prohibiting the reuse of identifiers prevents the assignment of previously used individual, group, role, service, or device identifiers to different individuals, groups, roles, services, or devices. Characteristics that identify the status of individuals include contractors, foreign nationals, and non-organizational users. Identifying the status of individuals by these characteristics provides information about the people with whom organizational personnel are communicating. For example, it is useful for an employee to know that one of the individuals on an email message is a contractor.

Evidence

  1. 03.05.05.a

    Receive authorization from organizational personnel or roles to assign an individual, group, role, service, or device identifier.

  1. 03.05.05.b

    Select and assign an identifier that identifies an individual, group, role, service, or device.

  1. 03.05.05.c

    Prevent the reuse of identifiers for at least ten (10) years.

  1. 03.05.05.d

    Manage individual identifiers by uniquely identifying each individual as privileged or non-privileged users; contractors, foreign nationals, and/or non-organizational users.