ComplianceNIST 800-53 control

NIST-IA-12 Identity Proofing

Official page ↗

Framework: NIST SP 800-53 rev5 (5.2.0)
Family: IA Identification and Authentication
Control: IA-12
ATT&CK techniques mitigated: 4

Control statement

a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines; b. Resolve user identities to a unique individual; and c. Collect, validate, and verify identity evidence.

Discussion

Identity proofing is the process of collecting, validating, and verifying a user’s identity information for the purposes of establishing credentials for accessing a system. Identity proofing is intended to mitigate threats to the registration of users and the establishment of their accounts. Standards and guidelines specifying identity assurance levels for identity proofing include [SP 800-63-3](#737513fa-6758-403f-831d-5ddab5e23cb3) and [SP 800-63A](#9099ed2c-922a-493d-bcb4-d896192243ff) . Organizations may be subject to laws, executive orders, directives, regulations, or policies that address the collection of identity evidence. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.

ATT&CK mappings (CTID)

• T1078 Valid Accounts • T1078.002 Domain Accounts • T1078.003 Local Accounts • T1078.004 Cloud Accounts

Mitigates · MITRE ATT&CK (4)

T1078.002 Domain Accounts sub-technique
T1078.003 Local Accounts sub-technique
T1078.004 Cloud Accounts sub-technique
T1078 Valid Accounts technique

Related control · Compliance (9)

NIST-AC-5 Separation of Duties NIST 800-53 control
NIST-IA-1 Policy and Procedures NIST 800-53 control
NIST-IA-13 Identity Providers and Authorization Servers NIST 800-53 control
NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
NIST-IA-3 Device Identification and Authentication NIST 800-53 control
NIST-IA-4 Identifier Management NIST 800-53 control
NIST-IA-5 Authenticator Management NIST 800-53 control
NIST-IA-6 Authentication Feedback NIST 800-53 control
NIST-IA-8 Identification and Authentication (Non-organizational Users) NIST 800-53 control

Referenced by Compliance · enhancement of (6)

NIST-IA-12(1) Supervisor Authorization NIST 800-53 enhancement
NIST-IA-12(2) Identity Evidence NIST 800-53 enhancement
NIST-IA-12(3) Identity Evidence Validation and Verification NIST 800-53 enhancement
NIST-IA-12(4) In-person Validation and Verification NIST 800-53 enhancement
NIST-IA-12(5) Address Confirmation NIST 800-53 enhancement
NIST-IA-12(6) Accept Externally-proofed Identities NIST 800-53 enhancement

Referenced by Compliance · has member (1)

NIST-IA Identification and Authentication NIST 800-53 family

Referenced by Compliance · related control (5)

NIST-AC-5 Separation of Duties NIST 800-53 control
NIST-IA-12(5) Address Confirmation NIST 800-53 enhancement
NIST-IA-13 Identity Providers and Authorization Servers NIST 800-53 control
NIST-IA-4 Identifier Management NIST 800-53 control
NIST-IA-5(16) In-person or Trusted External Party Authenticator Issuance NIST 800-53 enhancement