PR.AA-04 says identity assertions are protected, conveyed, and verified. An identity assertion is the statement one system makes to another, such as a signed login token from your single sign on provider saying who the user is. If those can be forged, replayed, or left unchecked, authentication does nothing.
What good looks like
Every app that trusts a login statement checks the signature, the audience, and the expiry. Tokens travel only over encrypted channels. Federation with partners uses standards, not homemade schemes.
NIST's examples: protect assertions used in single sign on and between federated systems, and use standards based approaches everywhere, following guidance on generating them, protecting them with signing and encryption, and verifying them through signature validation.
How to implement it
- Use standard protocols such as SAML or OpenID Connect for SSO. Avoid custom token formats.
- Validate signature, issuer, audience, and expiry in each relying application. Use well maintained libraries rather than writing validation yourself.
- Keep token lifetimes short and rotate signing keys on a schedule.
- Review federation connections yearly and remove those no longer needed.
- Include token handling in code review and dependency checks, because authentication libraries get vulnerabilities too.
Evidence to collect
- A list of SSO and federation connections with protocols used
- Configuration showing signature and audience validation
- Key rotation records
Common gaps
- Apps accept tokens without checking audience
- Signing keys never rotate
- Old federation links to former partners stay active
Quick check
Does turning on SSO satisfy this?
It is a start. The outcome is about how the assertions are protected and checked. Look at the settings in each connected app.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024), Appendix A, CSF Core: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 landing page: https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final
The CSF is voluntary guidance. There is no CSF certification, so nothing here makes a company "CSF certified". You describe your own practices against the outcomes.
