IA-8(6)

Requirement

Implement the following measures to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties: [Assignment: organization-defined measures].

Discussion

Federated identity solutions can create increased privacy risks due to the tracking and profiling of individuals. Using identifier mapping tables or cryptographic techniques to blind credential service providers and relying parties from each other or to make identity attributes less visible to transmitting parties can reduce these privacy risks.

Title

Identification and Authentication (non-organizational Users) | Disassociability
Family

Identification and Authentication
NIST 800-53B Baseline(s)

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Identification and authentication policy; system security plan; privacy plan; procedures addressing user identification and authentication; system design documentation; system configuration settings and associated documentation; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system operations responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers; organizational personnel with account management responsibilities].

Test

[SELECT FROM: Mechanisms supporting and/or implementing identification and authentication capabilities].

ID	Assessment Objectives
IA-08(06)	<IA-08(06)_ODP measures> to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties are implemented.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!