PR.AA-02 says identities are proofed and bound to credentials based on the context of interactions. Confirm a person is who they say they are when you create their account, then issue a credential that belongs only to them. How strict to be depends on what the account can reach.
What good looks like
Higher risk roles get stronger checks. Nobody shares a login. NIST's examples are to verify a claimed identity at enrollment using government issued credentials such as a passport or driver's license, and to issue a different credential to each person with no credential sharing.
How to implement it
- Define identity checks by role. Standard staff might need verified onboarding documents. Admins, finance, and anyone with production access might need an extra step, such as a live video check against a photo ID.
- For remote hires and contractors, make sure the person who shows up on day one is the person you vetted.
- Issue individual accounts only. Replace shared logins with named accounts and, where needed, a privileged access workflow that records who used what.
- Deliver first credentials safely, for example through an enrollment link sent to a verified channel, and require MFA setup at the first sign in.
- Record the proofing method used for each person.
Evidence to collect
- The identity proofing standard by role
- Onboarding records showing the check performed
- Proof that shared accounts are removed or controlled
Common gaps
- Contractor accounts created from an email request alone
- Shared admin or service logins used by several people
- Proofing was done at hiring, but password resets are approved by chat message
Quick check
Do we need to scan passports for every employee?
Not necessarily. The outcome says proofing should match context. Use stronger methods where the access is more sensitive and keep a record of what you did.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024), Appendix A, CSF Core: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 landing page: https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final
The CSF is voluntary guidance. There is no CSF certification, so nothing here makes a company "CSF certified". You describe your own practices against the outcomes.
