CCI-000201

Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.

Implementation Guidance

Determine if authenticators are protected commensurate with the security category of the information to which use of the authenticator permits access.

Validation Procedures

Examine: [SELECT FROM: Identification and authentication policy; procedures addressing authenticator management; security categorization documentation for the system; security assessments of authenticator protections; risk assessment results; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with authenticator management responsibilities; organizational personnel implementing and/or maintaining authenticator protections; organizational personnel with information security responsibilities; system/network administrators]. Test: [SELECT FROM: Mechanisms supporting and/or implementing authenticator management capability; mechanisms protecting authenticators].

The controls below (if any) were marked by NIST as being related to CCI-000201.