Does your organization use unique device identifiers based on immutable hardware characteristics or secure provisioning methods?
Explanation
Unique device identifiers are crucial for device authentication, inventory management, and security monitoring.
These identifiers should be either based on immutable hardware characteristics (like MAC addresses, CPU IDs, or hardware serial numbers) or securely provisioned to the device during manufacturing or initialization (such as TPM-based identifiers or cryptographic certificates).As evidence, you could provide documentation of your device identification scheme, including the source of identifiers (hardware-based or provisioned), how they are assigned and tracked, and how these identifiers are protected from tampering or spoofing.
This might include device enrollment procedures, inventory management system screenshots showing unique identifiers, or technical specifications for your device provisioning process.
Implementation Example
Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device
ID: PR.AA-01.196
Context
- Function
- PR: PROTECT
- Category
- PR.AA: Identity Management, Authentication, and Access Control
- Sub-Category
- Identities and credentials for authorized users, services, and hardware are managed by the organization
Related questions
- Does your organization have a formal process to request, track, review, and fulfill access requests that includes appropriate approval from system or data owners?
- Does your organization have a formal process for managing the lifecycle of cryptographic certificates, keys, identity tokens, and other credentials?
- Does your organization physically label all authorized hardware assets with unique identifiers for inventory tracking and servicing purposes?
- Does your organization verify individuals' identities during enrollment using government-issued credentials?
- Does your organization issue unique credentials to each individual user and prohibit credential sharing?
- Has your organization implemented multifactor authentication (MFA) for all user access to systems containing sensitive data?