Navigate

CCI-000187

CCI-000187 Definition

For public key-based authentication, map the authenticated identity to the account of the individual or group.

Status
Type	CheckType.technical

Master Assessment Datasheet

Implementation Guidance

The information system performing PKI-based authentication must be configured to map the authenticated PKI credential to a corresponding network or information system account or role in accordance with DoDI 8520.03. For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 187.

Validation Procedures

The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to map authenticated PKI credentials to corresponding network or information system accounts or roles in accordance with DoDI 8520.03. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 187.

Compelling Evidence

1.) Signed and dated SOP/TTP for configuring the information system mapping of the authenticated PKI credentials to a corresponding network or information system account or role in accordance with DoDI 8520.03. 2.) Applicable STIG/SRG checks

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000187.

Control	Description
IA-5(2)	The information system, for PKI-based authentication: (a): Validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information; (b): Enforces authorized access to the corresponding private key; (c): Maps the authenticated identity to the account of the individual or group; and (d): Implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.

Control

Description

IA-5(2)

The information system, for PKI-based authentication:

(a): Validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information;

(b): Enforces authorized access to the corresponding private key;

(c): Maps the authenticated identity to the account of the individual or group; and

(d): Implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.