IA-13 is new in Rev 5. It says to employ identity providers and authorization servers to manage user, device and non person entity identities, attributes and access rights, supporting authentication and authorization decisions. In plain terms: central identity, issued tokens, and a clear chain of trust.
800-53 binds federal systems and anyone held to it by contract. Everyone else can use IA-13 as a reference for a clean single sign on and token design.
What it means in practice
NIST explains that identity providers, internal or external, manage authenticators and issue assertions about identities. Authorization servers issue access tokens to authenticated users and devices. Single sign on provides both functions. Non person entities such as services and workloads count too, so your machine to machine credentials are in scope.
The value is consistency. One place decides who someone is. One place decides what a token allows. Applications check, they do not invent.
Evidence to collect
- An architecture diagram showing the identity provider, authorization server and relying applications.
- A list of applications integrated through SSO, and a list of the exceptions with reasons.
- Token settings: lifetime, scopes, signing method, refresh behavior.
- Key management records for the signing keys, covering rotation and access.
- Inventory of service identities and the tokens or certificates they use.
Common gaps
Applications that keep local accounts beside SSO. Long lived tokens with broad scope. Signing keys stored in a repo or shared by many people. Service accounts that never appear in any access review.
The enhancements name the three focus areas: IA-13.1 Protection of Cryptographic Keys, IA-13.2 Verification of Identity Assertions and Access Tokens, and IA-13.3 Token Management.
How to implement it
Pick one identity provider and route every application through it. Shorten token lifetimes, narrow scopes and verify signatures on every call. Move signing keys into managed key storage with logged access. Include service identities in your quarterly access review.
Quick check
Why does IA-13 mention non person entities?
Services and workloads authenticate and receive tokens too. Their identities need the same management as human accounts.
Which enhancement covers token lifetime and revocation practices?
IA-13.3 Token Management.
