IA-3(4)

Requirement

Handle device identification and authentication based on attestation by [Assignment: organization-defined configuration management process].

Discussion

Device attestation refers to the identification and authentication of a device based on its configuration and known operating state. Device attestation can be determined via a cryptographic hash of the device. If device attestation is the means of identification and authentication, then it is important that patches and updates to the device are handled via a configuration management process such that the patches and updates are done securely and do not disrupt identification and authentication to other devices.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Identification and authentication policy; system security plan; procedures addressing device identification and authentication; procedures addressing device configuration management; system design documentation; system configuration settings and associated documentation; configuration management records; change control records; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with operational responsibilities for device identification and authentication; organizational personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Mechanisms supporting and/or implementing device identification and authentication capabilities; mechanisms supporting and/or implementing configuration management; cryptographic mechanisms supporting device attestation].

ID	Assessment Objectives
IA-03(04)	device identification and authentication are handled based on attestation by <IA-03(04)_ODP configuration management process>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!