Users are not the only ones who connect. Laptops, servers, phones, printers and sensors do too. IA-3 requires you to uniquely identify and authenticate defined devices and types of devices before establishing a local, remote or network connection. Which devices and which connection types is your decision.
800-53 binds federal systems and contract holders. For others, it works as a reference. The same ask shows up as zero trust or device trust in customer questionnaires.
What it means in practice
NIST says devices are defined by type, by individual device, or both, and that the list can include devices the organization does not own. Identification can use shared known information, such as MAC or TCP/IP addresses, or stronger organizational authentication solutions. The guidance gives 802.1x and Extensible Authentication Protocol as examples of stronger approaches, along with certificate based methods.
An address is an identifier. It is not proof. Anyone can copy a MAC address, so address filtering alone rarely satisfies a careful reviewer for sensitive systems.
Evidence to collect
- A device inventory with owner, type and trust status.
- The network access policy showing which devices must authenticate and how.
- Certificate authority or MDM settings for device certificates, and a sample of issued certificates.
- Network access control or wireless configuration showing enforcement.
- A test record: an unknown device tried to connect and was refused.
Common gaps
Guest devices on the same segment as production. Servers that accept connections from any host in the network. A device certificate that never expires or is never revoked. IoT gear with a single shared password.
The enhancements push further: IA-3.1 Cryptographic Bidirectional Authentication, IA-3.2 Cryptographic Bidirectional Network Authentication, IA-3.3 Dynamic Address Allocation and IA-3.4 Device Attestation.
How to implement it
Start with the inventory, because you cannot authenticate what you have not listed. Issue certificates through MDM to company laptops and require them for VPN and Wi-Fi. Segment everything else. Remove devices from the allow list when they are retired.
Quick check
Is a MAC address allow list strong device authentication?
Not by itself. A MAC address identifies a device but is easy to spoof. Certificate based authentication is stronger.
