ComplianceNIST 800-53 control

NIST-IA-7 Cryptographic Module Authentication

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
IA Identification and Authentication
Control
IA-7
ATT&CK techniques mitigated
12

Control statement

Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication.

Discussion

Authentication mechanisms may be required within a cryptographic module to authenticate an operator accessing the module and to verify that the operator is authorized to assume the requested role and perform services within that role.

ATT&CK mappings (CTID)

• T1195.003 Compromise Hardware Supply Chain • T1495 Firmware Corruption • T1542 Pre-OS Boot • T1542.001 System Firmware • T1542.003 Bootkit • T1542.004 ROMMONkit • T1542.005 TFTP Boot • T1553 Subvert Trust Controls • T1553.006 Code Signing Policy Modification • T1601 Modify System Image • T1601.001 Patch System Image • T1601.002 Downgrade System Image

Related

Mitigates · MITRE ATT&CK (12)

  • T1553.006 Code Signing Policy Modification sub-technique
  • T1542.004 ROMMONkit sub-technique
  • T1542.005 TFTP Boot sub-technique
  • T1601 Modify System Image technique
  • T1601.001 Patch System Image sub-technique
  • T1601.002 Downgrade System Image sub-technique
  • T1195.003 Compromise Hardware Supply Chain sub-technique
  • T1553 Subvert Trust Controls technique
  • T1542.001 System Firmware sub-technique
  • T1542.003 Bootkit sub-technique
  • T1542 Pre-OS Boot technique
  • T1495 Firmware Corruption technique

Related control · Compliance (5)

  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
  • NIST-SC-13 Cryptographic Protection NIST 800-53 control

Referenced by Compliance · has member (1)

  • NIST-IA Identification and Authentication NIST 800-53 family

Referenced by Compliance · related control (5)

  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SA-4(7) NIAP-approved Protection Profiles NIST 800-53 enhancement
  • NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
  • NIST-SC-13 Cryptographic Protection NIST 800-53 control