IA-4(4) IDENTIFIER MANAGEMENT | IDENTIFY USER STATUS (M)(H)

NIST 800-53 (r4) Control:

The organization manages individual identifiers by uniquely identifying each individual as [FedRAMP Assignment: (M)(H) contractors, foreign nationals].

NIST 800-53 (r4) Supplemental Guidance:

Characteristics identifying the status of individuals include, for example, contractors and foreign nationals. Identifying the status of individuals by specific characteristics provides additional information about the people with whom organizational personnel are communicating. For example, it might be useful for a government employee to know that one of the individuals on an email message is a contractor. Related control: AT-2.

References: NIST Special Publication 800-40.

NIST 800-53 (r5) Discussion:

Characteristics that identify the status of individuals include contractors, foreign nationals, and non-organizational users. Identifying the status of individuals by these characteristics provides additional information about the people with whom organizational personnel are communicating. For example, it might be useful for a government employee to know that one of the individuals on an email message is a contractor. Related Controls: None.

38North Guidance:

Meets Minimum Requirement:

• Manages individual identifiers by uniquely identifying each individual as the organization-defined characteristic identifying individual status.

Best Practice:

• Consistent format for each type of user ID including a separate ID format for contractors and foreign nationals.

Unofficial FedRAMP Guidance: None

Assessment Evidence:

• Listing/Inventory of account IDs that demonstrate user IDs in use.

• Tickets demonstrating the account approval/creation process.

CSP Implementation Tips: TBD