3.5.4—Identification and Authentication - Derived
Derived Requirement
>Control Description
Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
>Discussion
Authentication processes resist replay attacks if it is impractical to successfully authenticate by recording or replaying previous authentication messages. Replay-resistant techniques include protocols that use nonces or challenges such as time synchronous or challenge-response one-time authenticators. [SP 800-63-3] provides guidance on digital identities.
>Cross-Framework Mappings
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What documented policies and procedures address identification and authentication - derived for CUI systems?
- •Who is accountable for implementing and maintaining identification and authentication - derived controls?
- •How frequently are identification and authentication - derived requirements reviewed, and what triggers updates?
- •What process ensures changes to systems maintain compliance with identification and authentication - derived requirements?
- •How are exceptions to identification and authentication - derived requirements documented and approved?
Technical Implementation:
- •What technical controls enforce identification and authentication - derived in your CUI environment?
- •How are identification and authentication - derived controls configured and maintained across all CUI systems?
- •What automated mechanisms support identification and authentication - derived compliance?
- •How do you validate that identification and authentication - derived implementations achieve their intended security outcome?
- •What compensating controls exist if primary identification and authentication - derived controls cannot be fully implemented?
Evidence & Documentation:
- •What documentation proves identification and authentication - derived is implemented and operating effectively?
- •Can you provide configuration evidence showing how identification and authentication - derived is technically enforced?
- •What audit logs or monitoring data demonstrate ongoing identification and authentication - derived compliance?
- •Can you show evidence of a recent review or assessment of identification and authentication - derived controls?
- •What artifacts would you provide to a CMMC assessor to demonstrate identification and authentication - derived compliance?
Ask AI
Configure your API key to use AI features.