IA-5(2)—Authenticator Management | Public Key-based Authentication

IL4 Mod

IL4 High

IL5

IL6

>Control Description

(a) For public key-based authentication: (1) Enforce authorized access to the corresponding private key; and (2) Map the authenticated identity to the account of the individual or group; and (b) When public key infrastructure (PKI) is used: (1) Validate certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information; and (2) Implement a local cache of revocation data to support path discovery and validation.

>DoD Impact Level Requirements

No specific parameter values or requirements for this impact level.

>Discussion

Public key cryptography is a valid authentication mechanism for individuals, machines, and devices. For PKI solutions, status information for certification paths includes certificate revocation lists or certificate status protocol responses. For PIV cards, certificate validation involves the construction and verification of a certification path to the Common Policy Root trust anchor, which includes certificate policy processing.

Implementing a local cache of revocation data to support path discovery and validation also supports system availability in situations where organizations are unable to access revocation information via the network.

>Programmatic Queries

Beta

Related Services

ACM

Certificate Manager

IAM

CLI Commands

Import client certificate

aws acm import-certificate --certificate fileb://Certificate.pem --certificate-chain fileb://CertificateChain.pem --private-key fileb://PrivateKey.pem

List imported certificates

aws acm list-certificates --certificate-status ISSUED --query 'CertificateSummaryList[*].{CertificateArn:CertificateArn,DomainName:DomainName}'

Validate certificate in use

aws acm describe-certificate --certificate-arn CERT_ARN --query 'Certificate.{Serial:Serial,NotAfter:NotAfter,Issuer:Issuer}'

Open AWS Console Documentation

>Related Controls

IA-3

SC-17

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

•What formal policies and procedures govern the implementation of IA-5(2) (Public Key-Based Authentication)?
•Who are the designated roles responsible for implementing, maintaining, and monitoring IA-5(2)?
•How frequently is the IA-5(2) policy reviewed and updated, and what triggers policy changes?
•What governance structure ensures IA-5(2) requirements are consistently applied across all systems?

Technical Implementation:

•Describe the specific technical mechanisms or controls used to enforce IA-5(2) requirements.
•What automated tools, systems, or technologies are deployed to implement IA-5(2)?
•How is IA-5(2) integrated into your system architecture and overall security posture?
•What configuration settings, parameters, or technical specifications enforce IA-5(2) requirements?

Evidence & Documentation:

•What documentation demonstrates the complete implementation of IA-5(2)?
•What audit logs, records, reports, or monitoring data validate IA-5(2) compliance?
•Can you provide evidence of periodic reviews, assessments, or testing of IA-5(2) effectiveness?
•What artifacts would you present during a FedRAMP assessment to demonstrate IA-5(2) compliance?

Ask AI

Configure your API key to use AI features.