An identifier is the name a system uses for a person, group, role, service or device. IA-4 Identifier Management asks you to run that naming process under control. It pairs with AC-2 Account Management, which uses the names IA-4 provides.
800-53 binds US federal systems and contract holders. Other companies can use it as a reference. When an auditor asks how you stop a former employee's username from being handed to a new hire, this is the control behind it.
What the control asks
Manage identifiers by:
- Receiving authorization from designated personnel to assign an identifier to an individual, group, role, service or device.
- Selecting an identifier that identifies it.
- Assigning the identifier to the intended party.
- Preventing reuse of identifiers for a period you define.
What it means in practice
NIST notes that common device identifiers are MAC addresses, IP addresses or device unique tokens. Individual identifiers are usually usernames. Identifier management for individual identifiers does not apply to shared system accounts.
Reuse matters for two reasons. Old access rights or old audit entries tied to a name can silently attach to a new owner. And logs lose meaning if one name refers to two people across time.
Evidence to collect
- The naming convention and the rule for who may approve a new identifier.
- Tickets or HR records showing authorization before creation.
- Directory configuration showing deleted or disabled identifiers are not available for reuse, and the retention period you set.
- A sample of leavers and the state of their identifiers.
- Service identity registry with owner per entry.
Common gaps
Usernames recycled after a departure. Email aliases reassigned. Service accounts created by developers with no ticket. Cloud roles named after a project that has ended and quietly reused.
The enhancements go deeper where needed: IA-4.1 Prohibit Account Identifiers as Public Identifiers, IA-4.2 Supervisor Authorization, IA-4.3 Multiple Forms of Certification, IA-4.4 Identify User Status, IA-4.5 Dynamic Management, IA-4.6 Cross-organization Management, IA-4.7 In-person Registration and IA-4.8 Pairwise Pseudonymous Identifiers. IA-4.4 is a practical one: mark contractors and employees differently in the identifier, so status is visible in logs.
How to implement it
Use immutable internal IDs in the directory and treat the display name as a label. Lock identifiers after deletion for a stated period, such as one year, and write that period in the standard. Tie creation to a ticket with an approver. Add status to the identifier or an attribute for contractor, employee and service.
Quick check
Why prevent reuse of identifiers?
So old permissions, logs and audit entries cannot be inherited by a different person or system under the same name.
Does IA-4 apply to shared accounts?
NIST says management of individual identifiers does not apply to shared system accounts.
