Navigate

IA-9 (2)

IA-9 (2): Transmission Of Decisions

The organization ensures that identification and authentication decisions are transmitted between [Assignment: organization-defined services] consistent with organizational policies.

Supplemental

For distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of identification and authentication claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide the identification and authentication decisions (as opposed to the actual identifiers and authenticators) to the services that need to act on those decisions.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to IA-9 (2).

Control	Description
SC-8	The information system protects the [Selection (one or more): confidentiality; integrity] of transmitted information.

Enhancements

The controls below (if any) add on to the requirements of IA-9 (2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to IA-9 (2).

CCI	Definition
CCI-002029	The organization defines the services between which identification decisions are to be transmitted.
CCI-002030	The organization defines the services between which authentication decisions are to be transmitted.
CCI-002031	The organization ensures that identification decisions are transmitted between organization-defined services consistent with organizational policies.
CCI-002032	The organization ensures that authentication decisions are transmitted between organization-defined services consistent with organizational policies.