PR.AA-01 Identity and credential management
Managing identities and credentials for users, services and hardware: access requests, certificates, tokens and keys, unique device identifiers and physical labeling of hardware.
PR.AA Identity management, authentication and access control
Identity Management, Authentication, and Access Control: identities and credentials, identity proofing, authentication, identity assertions, access permissions and physical access; six Subcategories.
PR.AA-02 Identity proofing
Proofing identities and binding them to credentials according to the context of the interaction, such as checking government-issued ID at enrollment and issuing one credential per person.
PR.AA-03 Authentication
Authenticating users, services and hardware: multifactor authentication, minimum authenticator strength, risk-based reauthentication and emergency access to accounts needed for safety.
PR.AA-04 Identity assertions protected
Protecting, conveying and verifying the identity assertions used by single sign-on and federation, with standards-based signing, encryption and signature validation.
PR.AA-05 Access permissions and least privilege
Defining access permissions in policy and managing, enforcing and reviewing them under least privilege and separation of duties, including attribute-based decisions and periodic access reviews.
PR.AA-06 Physical access
Managing, monitoring and enforcing physical access to assets in proportion to risk: guards, cameras, locks and alarms, extra controls for high-risk areas and escorts for visitors.
