myctrl.tools
Compare

IA-5(2)—Public Key-Based Authentication

MODERATE
HIGH

>Control Description

a

For public key-based authentication:

1.

Enforce authorized access to the corresponding private key; and

2.

Map the authenticated identity to the account of the individual or group; and

b

When public key infrastructure (PKI) is used:

1.

Validate certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information; and

2.

Implement a local cache of revocation data to support path discovery and validation.

>Cross-Framework Mappings

SCF

IAC-10.2
Compare

>Programmatic Queries

Beta

Related Services

ACM
Certificate Manager
IAM

CLI Commands

Import client certificate
aws acm import-certificate --certificate fileb://Certificate.pem --certificate-chain fileb://CertificateChain.pem --private-key fileb://PrivateKey.pem
List imported certificates
aws acm list-certificates --certificate-status ISSUED --query 'CertificateSummaryList[*].{CertificateArn:CertificateArn,DomainName:DomainName}'
Validate certificate in use
aws acm describe-certificate --certificate-arn CERT_ARN --query 'Certificate.{Serial:Serial,NotAfter:NotAfter,Issuer:Issuer}'
Open AWS ConsoleDocumentation

>Supplemental Guidance

Public key cryptography is a valid authentication mechanism for individuals, machines, and devices. For PKI solutions, status information for certification paths includes certificate revocation lists or certificate status protocol responses. For PIV cards, certificate validation involves the construction and verification of a certification path to the Common Policy Root trust anchor, which includes certificate policy processing.

Implementing a local cache of revocation data to support path discovery and validation also supports system availability in situations where organizations are unable to access revocation information via the network.

>Related Controls

IA-3
SC-17

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

  • •What formal policies and procedures govern the implementation of IA-5(2) (Public Key-Based Authentication)?
  • •Who are the designated roles responsible for implementing, maintaining, and monitoring IA-5(2)?
  • •How frequently is the IA-5(2) policy reviewed and updated, and what triggers policy changes?
  • •What governance structure ensures IA-5(2) requirements are consistently applied across all systems?

Technical Implementation:

  • •Describe the specific technical mechanisms or controls used to enforce IA-5(2) requirements.
  • •What automated tools, systems, or technologies are deployed to implement IA-5(2)?
  • •How is IA-5(2) integrated into your system architecture and overall security posture?
  • •What configuration settings, parameters, or technical specifications enforce IA-5(2) requirements?

Evidence & Documentation:

  • •What documentation demonstrates the complete implementation of IA-5(2)?
  • •What audit logs, records, reports, or monitoring data validate IA-5(2) compliance?
  • •Can you provide evidence of periodic reviews, assessments, or testing of IA-5(2) effectiveness?
  • •What artifacts would you present during a FedRAMP assessment to demonstrate IA-5(2) compliance?

Ask AI

Configure your API key to use AI features.