IA-5(6)

Requirement

Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.

Discussion

For systems that contain multiple security categories of information without reliable physical or logical separation between categories, authenticators used to grant access to the systems are protected commensurate with the highest security category of information on the systems. Security categories of information are determined as part of the security categorization process.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Identification and authentication policy; procedures addressing authenticator management; security categorization documentation for the system; security assessments of authenticator protections; risk assessment results; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with authenticator management responsibilities; organizational personnel implementing and/or maintaining authenticator protections; organizational personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Mechanisms supporting and/or implementing authenticator management capability; mechanisms protecting authenticators].

ID	Assessment Objectives
IA-05(06)	authenticators are protected commensurate with the security category of the information to which use of the authenticator permits access.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!