Navigate

CCI-000180

CCI-000180 Definition

The organization manages information system authenticators by establishing maximum lifetime restrictions for authenticators.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Per IA-5, CCI 1610, DoD has established the maximum lifetime restrictions for authenticators as CAC - every 3 years, or 1 year from term of contract Password: 60 days Biometrics: every 3 years.

Validation Procedures

Per IA-5, CCI 1610, DoD has established the maximum lifetime restrictions for authenticators as CAC - every 3 years, or 1 year from term of contract Password: 60 days Biometrics: every 3 years.

Compelling Evidence

1.) Signed and dated Key Management Policy establishing maximum lifetime restrictions for authenticators

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000180.

Control	Description
IA-5	The organization manages information system authenticators by: IA-5a.: Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving the authenticator; IA-5b.: Establishing initial authenticator content for authenticators defined by the organization; IA-5c.: Ensuring that authenticators have sufficient strength of mechanism for their intended use; IA-5d.: Establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised or damaged authenticators, and for revoking authenticators; IA-5e.: Changing default content of authenticators prior to information system installation; IA-5f.: Establishing minimum and maximum lifetime restrictions and reuse conditions for authenticators; IA-5g.: Changing/refreshing authenticators [Assignment: organization-defined time period by authenticator type]; IA-5h.: Protecting authenticator content from unauthorized disclosure and modification; IA-5i.: Requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators; and IA-5j.: Changing authenticators for group/role accounts when membership to those accounts changes.

Control

Description

IA-5

The organization manages information system authenticators by:

IA-5a.: Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving the authenticator;

IA-5b.: Establishing initial authenticator content for authenticators defined by the organization;

IA-5c.: Ensuring that authenticators have sufficient strength of mechanism for their intended use;

IA-5d.: Establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised or damaged authenticators, and for revoking authenticators;

IA-5e.: Changing default content of authenticators prior to information system installation;

IA-5f.: Establishing minimum and maximum lifetime restrictions and reuse conditions for authenticators;

IA-5g.: Changing/refreshing authenticators [Assignment: organization-defined time period by authenticator type];

IA-5h.: Protecting authenticator content from unauthorized disclosure and modification;

IA-5i.: Requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators; and

IA-5j.: Changing authenticators for group/role accounts when membership to those accounts changes.