Browse 1,193 controls and enhancements across 20 security and privacy families. Use the GovRAMP crosswalk to locate controls referenced by Security Snapshot, Core, and Moderate.
A shared catalog supports common-control planning; designation as a common, hybrid, or system-specific control depends on your organization’s implementation and inheritance decisions.
Sources and crosswalk scope
NIST OSCAL content 5.1.1+u4, retrieved 2026-09-18. GovRAMP Snapshot v1.4 and Core selection from Moderate v1.06 reference the December 2020 Rev. 5 text. Mappings establish exact identifier correspondence, not identical requirements, inherited implementation, or GovRAMP authorization. GovRAMP parameters and additional requirements remain authoritative for each program. Full Moderate, High, and other programs are not mapped here. Withdrawn controls are retained for reference.
Official pinned NIST sourceSHA-256: 81cf2de45ede9aef3de7ce09d65ea9d32f662c483bbf916f6e346292b22f7763
Identification and Authentication · Enhancement
IA-4(6) · Cross-organization Management
View parent controlControl statement and discussion
NIST control statement
Coordinate with the following external organizations for cross-organization management of identifiers: [Assignment: external organizations].
Discussion
Cross-organization identifier management provides the capability to identify individuals, groups, roles, or devices when conducting cross-organization activities involving the processing, storage, or transmission of information.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-4(8) · Pairwise Pseudonymous Identifiers
View parent controlControl statement and discussion
NIST control statement
Generate pairwise pseudonymous identifiers.
Discussion
A pairwise pseudonymous identifier is an opaque unguessable subscriber identifier generated by an identity provider for use at a specific individual relying party. Generating distinct pairwise pseudonymous identifiers with no identifying information about a subscriber discourages subscriber activity tracking and profiling beyond the operational requirements established by an organization. The pairwise pseudonymous identifiers are unique to each relying party except in situations where relying parties can show a demonstrable relationship justifying an operational need for correlation, or all parties consent to being correlated in such a manner.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-4(9) · Attribute Maintenance and Protection
View parent controlControl statement and discussion
NIST control statement
Maintain the attributes for each uniquely identified individual, device, or service in [Assignment: protected central storage].
Discussion
For each of the entities covered in [IA-2](#ia-2), [IA-3](#ia-3), [IA-8](#ia-8) , and [IA-9](#ia-9) , it is important to maintain the attributes for each authenticated entity on an ongoing basis in a central (protected) store.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Base control
IA-5 · Authenticator Management
Control statement and discussion
NIST control statement
Manage system authenticators by:
a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator;
b. Establishing initial authenticator content for any authenticators issued by the organization;
c. Ensuring that authenticators have sufficient strength of mechanism for their intended use;
d. Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators;
e. Changing default authenticators prior to first use;
f. Changing or refreshing authenticators [Assignment: time period by authenticator type] or when [Assignment: events] occur;
g. Protecting authenticator content from unauthorized disclosure and modification;
h. Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and
i. Changing authenticators for group or role accounts when membership to those accounts changes.
Discussion
Authenticators include passwords, cryptographic devices, biometrics, certificates, one-time password devices, and ID badges. Device authenticators include certificates and passwords. Initial authenticator content is the actual content of the authenticator (e.g., the initial password). In contrast, the requirements for authenticator content contain specific criteria or characteristics (e.g., minimum password length). Developers may deliver system components with factory default authentication credentials (i.e., passwords) to allow for initial installation and configuration. Default authentication credentials are often well known, easily discoverable, and present a significant risk. The requirement to protect individual authenticators may be implemented via control [PL-4](#pl-4) or [PS-6](#ps-6) for authenticators in the possession of individuals and by controls [AC-3](#ac-3), [AC-6](#ac-6) , and [SC-28](#sc-28) for authenticators stored in organizational systems, including passwords stored in hashed or encrypted formats or files containing encrypted or hashed passwords accessible with administrator privileges.
Systems support authenticator management by organization-defined settings and restrictions for various authenticator characteristics (e.g., minimum password length, validation time window for time synchronous one-time tokens, and number of allowed rejections during the verification stage of biometric authentication). Actions can be taken to safeguard individual authenticators, including maintaining possession of authenticators, not sharing authenticators with others, and immediately reporting lost, stolen, or compromised authenticators. Authenticator management includes issuing and revoking authenticators for temporary access when no longer needed.
GovRAMP crosswalk
- GovRAMP Security Snapshot Readiness · IA-5 — Direct NIST identifier reference. GovRAMP source matrix
- GovRAMP Core Readiness — 60 Controls · IA-5 — Direct NIST identifier reference. GovRAMP source matrix
- GovRAMP Moderate Readiness · IA-5 — Direct NIST identifier reference. GovRAMP source matrix
Identification and Authentication · Enhancement
IA-5(1) · Password-based Authentication
View parent controlControl statement and discussion
NIST control statement
For password-based authentication:
(a) Maintain a list of commonly-used, expected, or compromised passwords and update the list [Assignment: frequency] and when organizational passwords are suspected to have been compromised directly or indirectly;
(b) Verify, when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5(1)(a);
(c) Transmit passwords only over cryptographically-protected channels;
(d) Store passwords using an approved salted key derivation function, preferably using a keyed hash;
(e) Require immediate selection of a new password upon account recovery;
(f) Allow user selection of long passwords and passphrases, including spaces and all printable characters;
(g) Employ automated tools to assist the user in selecting strong password authenticators; and
(h) Enforce the following composition and complexity rules: [Assignment: composition and complexity rules].
Discussion
Password-based authentication applies to passwords regardless of whether they are used in single-factor or multi-factor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.
GovRAMP crosswalk
- GovRAMP Security Snapshot Readiness · IA-5 (1) — Direct NIST identifier reference. GovRAMP source matrix
- GovRAMP Core Readiness — 60 Controls · IA-5 (1) — Direct NIST identifier reference. GovRAMP source matrix
- GovRAMP Moderate Readiness · IA-5 (1) — Direct NIST identifier reference. GovRAMP source matrix
Identification and Authentication · Enhancement
IA-5(2) · Public Key-based Authentication
View parent controlControl statement and discussion
NIST control statement
(a) For public key-based authentication:
(1) Enforce authorized access to the corresponding private key; and
(2) Map the authenticated identity to the account of the individual or group; and
(b) When public key infrastructure (PKI) is used:
(1) Validate certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information; and
(2) Implement a local cache of revocation data to support path discovery and validation.
Discussion
Public key cryptography is a valid authentication mechanism for individuals, machines, and devices. For PKI solutions, status information for certification paths includes certificate revocation lists or certificate status protocol responses. For PIV cards, certificate validation involves the construction and verification of a certification path to the Common Policy Root trust anchor, which includes certificate policy processing. Implementing a local cache of revocation data to support path discovery and validation also supports system availability in situations where organizations are unable to access revocation information via the network.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IA-5 (2) — Direct NIST identifier reference. GovRAMP source matrix
Identification and Authentication · Enhancement
IA-5(5) · Change Authenticators Prior to Delivery
View parent controlControl statement and discussion
NIST control statement
Require developers and installers of system components to provide unique authenticators or change default authenticators prior to delivery and installation.
Discussion
Changing authenticators prior to the delivery and installation of system components extends the requirement for organizations to change default authenticators upon system installation by requiring developers and/or installers to provide unique authenticators or change default authenticators for system components prior to delivery and/or installation. However, it typically does not apply to developers of commercial off-the-shelf information technology products. Requirements for unique authenticators can be included in acquisition documents prepared by organizations when procuring systems or system components.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-5(6) · Protection of Authenticators
View parent controlControl statement and discussion
NIST control statement
Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.
Discussion
For systems that contain multiple security categories of information without reliable physical or logical separation between categories, authenticators used to grant access to the systems are protected commensurate with the highest security category of information on the systems. Security categories of information are determined as part of the security categorization process.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IA-5 (6) — Direct NIST identifier reference. GovRAMP source matrix
Identification and Authentication · Enhancement
IA-5(7) · No Embedded Unencrypted Static Authenticators
View parent controlControl statement and discussion
NIST control statement
Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage.
Discussion
In addition to applications, other forms of static storage include access scripts and function keys. Organizations exercise caution when determining whether embedded or stored authenticators are in encrypted or unencrypted form. If authenticators are used in the manner stored, then those representations are considered unencrypted authenticators.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IA-5 (7) — Direct NIST identifier reference. GovRAMP source matrix
Identification and Authentication · Enhancement
IA-5(8) · Multiple System Accounts
View parent controlControl statement and discussion
NIST control statement
Implement [Assignment: security controls] to manage the risk of compromise due to individuals having accounts on multiple systems.
Discussion
When individuals have accounts on multiple systems and use the same authenticators such as passwords, there is the risk that a compromise of one account may lead to the compromise of other accounts. Alternative approaches include having different authenticators (passwords) on all systems, employing a single sign-on or federation mechanism, or using some form of one-time passwords on all systems. Organizations can also use rules of behavior (see [PL-4](#pl-4) ) and access agreements (see [PS-6](#ps-6) ) to mitigate the risk of multiple system accounts.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-5(9) · Federated Credential Management
View parent controlControl statement and discussion
NIST control statement
Use the following external organizations to federate credentials: [Assignment: external organizations].
Discussion
Federation provides organizations with the capability to authenticate individuals and devices when conducting cross-organization activities involving the processing, storage, or transmission of information. Using a specific list of approved external organizations for authentication helps to ensure that those organizations are vetted and trusted.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-5(10) · Dynamic Credential Binding
View parent controlControl statement and discussion
NIST control statement
Bind identities and authenticators dynamically using the following rules: [Assignment: binding rules].
Discussion
Authentication requires some form of binding between an identity and the authenticator that is used to confirm the identity. In conventional approaches, binding is established by pre-provisioning both the identity and the authenticator to the system. For example, the binding between a username (i.e., identity) and a password (i.e., authenticator) is accomplished by provisioning the identity and authenticator as a pair in the system. New authentication techniques allow the binding between the identity and the authenticator to be implemented external to a system. For example, with smartcard credentials, the identity and authenticator are bound together on the smartcard. Using these credentials, systems can authenticate identities that have not been pre-provisioned, dynamically provisioning the identity after authentication. In these situations, organizations can anticipate the dynamic provisioning of identities. Pre-established trust relationships and mechanisms with appropriate authorities to validate identities and related credentials are essential.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-5(12) · Biometric Authentication Performance
View parent controlControl statement and discussion
NIST control statement
For biometric-based authentication, employ mechanisms that satisfy the following biometric quality requirements [Assignment: biometric quality requirements].
Discussion
Unlike password-based authentication, which provides exact matches of user-input passwords to stored passwords, biometric authentication does not provide exact matches. Depending on the type of biometric and the type of collection mechanism, there is likely to be some divergence from the presented biometric and the stored biometric that serves as the basis for comparison. Matching performance is the rate at which a biometric algorithm correctly results in a match for a genuine user and rejects other users. Biometric performance requirements include the match rate, which reflects the accuracy of the biometric matching algorithm used by a system.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-5(13) · Expiration of Cached Authenticators
View parent controlControl statement and discussion
NIST control statement
Prohibit the use of cached authenticators after [Assignment: time period].
Discussion
Cached authenticators are used to authenticate to the local machine when the network is not available. If cached authentication information is out of date, the validity of the authentication information may be questionable.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-5(14) · Managing Content of PKI Trust Stores
View parent controlControl statement and discussion
NIST control statement
For PKI-based authentication, employ an organization-wide methodology for managing the content of PKI trust stores installed across all platforms, including networks, operating systems, browsers, and applications.
Discussion
An organization-wide methodology for managing the content of PKI trust stores helps improve the accuracy and currency of PKI-based authentication credentials across the organization.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-5(15) · GSA-approved Products and Services
View parent controlControl statement and discussion
NIST control statement
Use only General Services Administration-approved products and services for identity, credential, and access management.
Discussion
General Services Administration (GSA)-approved products and services are products and services that have been approved through the GSA conformance program, where applicable, and posted to the GSA Approved Products List. GSA provides guidance for teams to design and build functional and secure systems that comply with Federal Identity, Credential, and Access Management (FICAM) policies, technologies, and implementation patterns.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-5(16) · In-person or Trusted External Party Authenticator Issuance
View parent controlControl statement and discussion
NIST control statement
Require that the issuance of [Assignment: types of and/or specific authenticators] be conducted [Selection (one): in person; by a trusted external party] before [Assignment: registration authority] with authorization by [Assignment: personnel or roles].
Discussion
Issuing authenticators in person or by a trusted external party enhances and reinforces the trustworthiness of the identity proofing process.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-5(17) · Presentation Attack Detection for Biometric Authenticators
View parent controlControl statement and discussion
NIST control statement
Employ presentation attack detection mechanisms for biometric-based authentication.
Discussion
Biometric characteristics do not constitute secrets. Such characteristics can be obtained by online web accesses, taking a picture of someone with a camera phone to obtain facial images with or without their knowledge, lifting from objects that someone has touched (e.g., a latent fingerprint), or capturing a high-resolution image (e.g., an iris pattern). Presentation attack detection technologies including liveness detection, can mitigate the risk of these types of attacks by making it difficult to produce artifacts intended to defeat the biometric sensor.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-5(18) · Password Managers
View parent controlControl statement and discussion
NIST control statement
(a) Employ [Assignment: password managers] to generate and manage passwords; and
(b) Protect the passwords using [Assignment: controls].
Discussion
For systems where static passwords are employed, it is often a challenge to ensure that the passwords are suitably complex and that the same passwords are not employed on multiple systems. A password manager is a solution to this problem as it automatically generates and stores strong and different passwords for various accounts. A potential risk of using password managers is that adversaries can target the collection of passwords generated by the password manager. Therefore, the collection of passwords requires protection including encrypting the passwords (see [IA-5(1)(d)](#ia-5.1_smt.d) ) and storing the collection offline in a token.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Base control
IA-6 · Authentication Feedback
Control statement and discussion
NIST control statement
Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.
Discussion
Authentication feedback from systems does not provide information that would allow unauthorized individuals to compromise authentication mechanisms. For some types of systems, such as desktops or notebooks with relatively large monitors, the threat (referred to as shoulder surfing) may be significant. For other types of systems, such as mobile devices with small displays, the threat may be less significant and is balanced against the increased likelihood of typographic input errors due to small keyboards. Thus, the means for obscuring authentication feedback is selected accordingly. Obscuring authentication feedback includes displaying asterisks when users type passwords into input devices or displaying feedback for a very limited time before obscuring it.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IA-6 — Direct NIST identifier reference. GovRAMP source matrix
Identification and Authentication · Base control
IA-7 · Cryptographic Module Authentication
Control statement and discussion
NIST control statement
Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication.
Discussion
Authentication mechanisms may be required within a cryptographic module to authenticate an operator accessing the module and to verify that the operator is authorized to assume the requested role and perform services within that role.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IA-7 — Direct NIST identifier reference. GovRAMP source matrix
Identification and Authentication · Base control
IA-8 · Identification and Authentication (Non-organizational Users)
Control statement and discussion
NIST control statement
Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
Discussion
Non-organizational users include system users other than organizational users explicitly covered by [IA-2](#ia-2) . Non-organizational users are uniquely identified and authenticated for accesses other than those explicitly identified and documented in [AC-14](#ac-14) . Identification and authentication of non-organizational users accessing federal systems may be required to protect federal, proprietary, or privacy-related information (with exceptions noted for national security systems). Organizations consider many factors—including security, privacy, scalability, and practicality—when balancing the need to ensure ease of use for access to federal information and systems with the need to protect and adequately mitigate risk.
GovRAMP crosswalk
- GovRAMP Core Readiness — 60 Controls · IA-8 — Direct NIST identifier reference. GovRAMP source matrix
- GovRAMP Moderate Readiness · IA-8 — Direct NIST identifier reference. GovRAMP source matrix
Identification and Authentication · Enhancement
IA-8(1) · Acceptance of PIV Credentials from Other Agencies
View parent controlControl statement and discussion
NIST control statement
Accept and electronically verify Personal Identity Verification-compliant credentials from other federal agencies.
Discussion
Acceptance of Personal Identity Verification (PIV) credentials from other federal agencies applies to both logical and physical access control systems. PIV credentials are those credentials issued by federal agencies that conform to FIPS Publication 201 and supporting guidelines. The adequacy and reliability of PIV card issuers are addressed and authorized using [SP 800-79-2](#10963761-58fc-4b20-b3d6-b44a54daba03).
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-8(2) · Acceptance of External Authenticators
View parent controlControl statement and discussion
NIST control statement
(a) Accept only external authenticators that are NIST-compliant; and
(b) Document and maintain a list of accepted external authenticators.
Discussion
Acceptance of only NIST-compliant external authenticators applies to organizational systems that are accessible to the public (e.g., public-facing websites). External authenticators are issued by nonfederal government entities and are compliant with [SP 800-63B](#e59c5a7c-8b1f-49ca-8de0-6ee0882180ce) . Approved external authenticators meet or exceed the minimum Federal Government-wide technical, security, privacy, and organizational maturity requirements. Meeting or exceeding Federal requirements allows Federal Government relying parties to trust external authenticators in connection with an authentication transaction at a specified authenticator assurance level.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IA-8 (2) — Direct NIST identifier reference. GovRAMP source matrix
Identification and Authentication · Enhancement
IA-8(4) · Use of Defined Profiles
View parent controlControl statement and discussion
NIST control statement
Conform to the following profiles for identity management [Assignment: identity management profiles].
Discussion
Organizations define profiles for identity management based on open identity management standards. To ensure that open identity management standards are viable, robust, reliable, sustainable, and interoperable as documented, the Federal Government assesses and scopes the standards and technology implementations against applicable laws, executive orders, directives, policies, regulations, standards, and guidelines.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IA-8 (4) — Direct NIST identifier reference. GovRAMP source matrix
