PR.AA-01.196
Does your organization use unique device identifiers based on immutable hardware characteristics or secure provisioning methods?
Explanation
Unique device identifiers are crucial for device authentication, inventory management, and security monitoring. These identifiers should be either based on immutable hardware characteristics (like MAC addresses, CPU IDs, or hardware serial numbers) or securely provisioned to the device during manufacturing or initialization (such as TPM-based identifiers or cryptographic certificates).As evidence, you could provide documentation of your device identification scheme, including the source of identifiers (hardware-based or provisioned), how they are assigned and tracked, and how these identifiers are protected from tampering or spoofing. This might include device enrollment procedures, inventory management system screenshots showing unique identifiers, or technical specifications for your device provisioning process.
Implementation Example
Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device
ID: PR.AA-01.196
Context
- Function
- PR: PROTECT
- Category
- PR.AA: Identity Management, Authentication, and Access Control
- Sub-Category
- Identities and credentials for authorized users, services, and hardware are managed by the organization
