IA-13—Identity Providers And Authorization Servers
>Control Description
Employ identity providers and authorization servers to manage user, device, and non-person entity (NPE) identities, attributes, and access rights supporting authentication and authorization decisions in accordance with ⚙organization-defined identification and authentication policy using ⚙organization-defined mechanisms.
>Control Enhancements(3)
>Cross-Framework Mappings
NIST CSF 2.0
via NIST CSF 2.0 Concept Crosswalk>Supplemental Guidance
Identity providers, both internal and external to the organization, manage the user, device, and NPE authenticators and issue statements, often called identity assertions, attesting to identities of other systems or systems components. Authorization servers create and issue access tokens to identified and authenticated users and devices that can be used to gain access to system or information resources. For example, single sign-on (SSO) provides identity provider and authorization server functions.
Authenticator management (to include credential management) is covered by IA-05.
>Related Controls
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What formal policies and procedures govern the implementation of IA-13 (Identity Providers And Authorization Servers)?
- •Who are the designated roles responsible for implementing, maintaining, and monitoring IA-13?
- •How frequently is the IA-13 policy reviewed and updated, and what triggers policy changes?
- •What governance structure ensures IA-13 requirements are consistently applied across all systems?
Technical Implementation:
- •Describe the specific technical mechanisms or controls used to enforce IA-13 requirements.
- •What automated tools, systems, or technologies are deployed to implement IA-13?
- •How is IA-13 integrated into your system architecture and overall security posture?
- •What configuration settings, parameters, or technical specifications enforce IA-13 requirements?
Evidence & Documentation:
- •What documentation demonstrates the complete implementation of IA-13?
- •What audit logs, records, reports, or monitoring data validate IA-13 compliance?
- •Can you provide evidence of periodic reviews, assessments, or testing of IA-13 effectiveness?
- •What artifacts would you present during a FedRAMP assessment to demonstrate IA-13 compliance?
Ask AI
Configure your API key to use AI features.