Navigate

CCI-005168

CCI-005168 Definition

Access tokens are time-restricted in accordance with organization-defined identification and authentication policy.

Status
Type	CheckType.technical

Master Assessment Datasheet

Implementation Guidance

Determine if:- assertions are time-restricted in accordance with IA-13(03)_ODP policy; and- access tokens are time-restricted in accordance with IA-13(03)_ODP policy;

Validation Procedures

Examine: [SELECT FROM: Identification and authentication policy; access control policy; procedures for assertion and token management; system design documentation; system configuration settings and associated documentation; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system operations responsibilities; organizational personnel with information security responsibilities; system/ network administrators; organizational personnel with account management responsibilities; system developers]. Test: [SELECT FROM: Mechanisms and software supporting and/or implementing token generation].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-005168.

Control	Description
IA-13(3)	In accordance with [identification and authentication policy is defined;], assertions and access tokens are: (a): generated; (b): issued; (c): refreshed; (d): revoked; (e): time-restricted; and (f): audience-restricted.