IA-2(8)

Requirement

Implement replay-resistant authentication mechanisms for access to [Selection (one or more): privileged accounts; non-privileged accounts].

Discussion

Authentication processes resist replay attacks if it is impractical to achieve successful authentications by replaying previous authentication messages. Replay-resistant techniques include protocols that use nonces or challenges such as time synchronous or cryptographic authenticators.

Title

Identification and Authentication (organizational Users) | Access to Accounts — Replay Resistant
Family

Identification and Authentication
NIST 800-53B Baseline(s)
- Low
- Moderate
- High

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Identification and authentication policy; system security plan; procedures addressing user identification and authentication; system design documentation; system configuration settings and associated documentation; system audit records; list of privileged system accounts; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system operations responsibilities; organizational personnel with account management responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers].

Test

[SELECT FROM: Mechanisms supporting and/or implementing identification and authentication capabilities; Mechanisms supporting and/or implementing replay-resistant authentication mechanisms].

ID	Assessment Objectives
IA-02(08)	replay-resistant authentication mechanisms for access to <IA-02(08)_ODP SELECTED PARAMETER VALUES> are implemented.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!