Identification and Authentication, Authorization, and Access Control Only answer if the answer is consistently For partially implemented areas, answer and “yes” “yes”. “no” describe what is missing to achieve a answer. If inherited, please indicate partial or full inheritance “yes” in the Capability” column. Any non-inherited capabilities must be described. “Describe Table 5-4. Identification and Authentication, Authorization, and Access Control Describe capability, supporting evidence, and any Question Yes No missing elements Does the system identify and authorize users in a manner that cannot be repudiated and which sufficiently reduces the risk of impersonation? [IA-2] Does the system require authentication (MFA) for administrative accounts and functions? [IA-2, IA-2(1), IA-2(3), IA-2(11)] Does the system enforce all DoD traffic through a DoD CAP? CA-3(1,3)] Does the system uniquely identify each individual user? [IA-4, IA-4(4)] Does the system uniquely identify each individual device before allowing connection? [IA-3] Does the system fully comply with State the eAuth Level, and provide sufficient details eAuth Level 3 or higher? [NIST SP that justify this level, consistent with NIST SP 800-63. 800-63] Does the system enforce DoD PKI, PKE and use a DoD PKI registration authority? [IA-5, IA-5(3)] Does the system restrict personnel’s access to resources and the CSP review those privileges? [AC-6(2), AC-6(7)] Does the system design ensure that a process cannot elevate its privileges above the user? [AC-6(8), SI-16] Does the system restrict privileged users from performing function? [AC-6(10)] Does the system ensure secure separation of customer data and data flows [SC-4, AC-4(21)]
Identification and Authentication, Authorization, and Access Control Only answer “yes” if the answer is consistently “yes”. For partially implemented areas, answer “no” and describe what is missing to achieve a “yes” answer. If inherited, please indicate partial or full inheritance in the “Describe Capability” column. Any non-inherited capabilities must be described. Table 5-4. Identification and Authentication, Authorization, and Access Control Question Yes No Describe capability, supporting evidence, and any missing elements Does the system identify and authorize users in a manner that cannot be repudiated and which sufficiently reduces the risk of impersonation? [IA-2] Does the system require authentication (MFA) for administrative accounts and functions? [IA-2, IA-2(1), IA-2(3), IA-2(11)] Does the system enforce all DoD traffic through a DoD CAP? CA-3(1,3)] Does the system uniquely identify each individual user? [IA-4, IA-4(4)] Does the system uniquely identify each individual device before allowing connection? [IA-3] Does the system fully comply with eAuth Level 3 or higher? [NIST SP 800-63] State the eAuth Level, and provide sufficient details that justify this level, consistent with NIST SP 800-63. Does the system enforce DoD PKI, PKE and use a DoD PKI registration authority? [IA-5, IA-5(3)] Does the system restrict personnel’s access to resources and the CSP review those privileges? [AC-6(2), AC-6(7)] Does the system design ensure that a process cannot elevate its privileges above the user? [AC-6(8), SI-16] Does the system restrict users from performing privileged function? [AC-6(10)] Does the system ensure secure separation of customer data and data flows [SC-4, AC-4(21)]
DoD_RAR_template_DRAFT_%28002%29.docx