IA-5 · Identification and Authentication · NIST SP 800-53 Rev5
IA-5: Authenticators are managed with strength, rotation, and protection requirements
How NIST SP 800-53 Rev5 control IA-5 (Identification and Authentication) maps to FedRAMP 20x Key Security Indicators, and the evidence scm.cc collects for it.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
What IA-5 requires
Authenticators are managed with strength, rotation, and protection requirements.
Paraphrased from NIST SP 800-53 Rev. 5 — Security and Privacy Controls for Information Systems and Organizations (checked 2026-10-31). scm.cc does not reproduce the official control text; read the NIST catalog for the normative wording.
FedRAMP 20x KSIs that cover IA-5
These Key Security Indicators officially cite IA-5 as a related SP 800-53 control, so satisfying them is how a 20x package demonstrates this control.
KSI-IAM-APM — Adopting Passwordless Methods
Identity and Access Management · official related-control citation: ia-5, ia-5.1, ia-5.2, ia-5.6, ia-5.8
KSI-IAM-ELP — Ensuring Least Privilege
Identity and Access Management · official related-control citation: ia-5.2, ia-5.6
KSI-IAM-SNU — Securing Non-User Authentication
Identity and Access Management · official related-control citation: ia-5.2
KSI-PIY-RSD — Reviewing Security in the SDLC
Policy and Inventory · official related-control citation: ia-5.7
KSI-SVC-ASM — Automating Secret Management
Service Configuration · official related-control citation: ia-5.2, ia-5.6
Evidence scm.cc collects for IA-5
scm.cc tracks this as manual evidence you attach; it validates and replays exactly what you provide (no automated claim beyond that).