CCI-001966

Handle device identification based on attestation is handled by the organization-defined configuration management process.

Implementation Guidance

The organization being inspected/assessed ensures that device identification based on attestation is handled by the configuration management process defined in IA-3 (4), CCI 1968.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented configuration management process to ensure the organization being inspected/assessed has device identification based on attestation handled via the configuration management process.

Compelling Evidence

1.) Signed and dated Configuration Management Policy, referencing device identification section.

The controls below (if any) were marked by NIST as being related to CCI-001966.