IA-5 (08)—Authenticator Management | Multiple System Accounts

High

>Control Description

Implement ⚙organization-defined security controls to manage the risk of compromise due to individuals having accounts on multiple systems.

>FedRAMP Baseline Requirements

Parameter Values

Additional Requirements and Guidance

IA-5 (8) Guidance: If a single user authentication domain is used to access multiple systems, such as in single-sign-on, then only a single authenticator is required.

>Discussion

When individuals have accounts on multiple systems and use the same authenticators such as passwords, there is the risk that a compromise of one account may lead to the compromise of other accounts. Alternative approaches include having different authenticators (passwords) on all systems, employing a single sign-on or federation mechanism, or using some form of one-time passwords on all systems. Organizations can also use rules of behavior (see PL-4) and access agreements (see PS-6) to mitigate the risk of multiple system accounts.

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

•What formal policies and procedures govern the implementation of IA-5(8) (Multiple System Accounts)?
•Who are the designated roles responsible for implementing, maintaining, and monitoring IA-5(8)?
•How frequently is the IA-5(8) policy reviewed and updated, and what triggers policy changes?
•What governance structure ensures IA-5(8) requirements are consistently applied across all systems?

Technical Implementation:

•Describe the specific technical mechanisms or controls used to enforce IA-5(8) requirements.
•What automated tools, systems, or technologies are deployed to implement IA-5(8)?
•How is IA-5(8) integrated into your system architecture and overall security posture?
•What configuration settings, parameters, or technical specifications enforce IA-5(8) requirements?

Evidence & Documentation:

•What documentation demonstrates the complete implementation of IA-5(8)?
•What audit logs, records, reports, or monitoring data validate IA-5(8) compliance?
•Can you provide evidence of periodic reviews, assessments, or testing of IA-5(8) effectiveness?
•What artifacts would you present during a FedRAMP assessment to demonstrate IA-5(8) compliance?

Ask AI

Configure your API key to use AI features.