[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fia-4":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ia-4","IA-4","Identifier Management",19,"US National Institute of Standards and Technology (NIST)","**What it asks for.** System identifiers must be managed by obtaining authorisation before assigning them, assigning them to the intended individual, group, role, service or device, preventing reuse for a defined period and handling them consistently.\n\n**In practice.** This means unique, non-reused usernames and identifiers allocated through the identity governance process, naming conventions that distinguish privileged and service accounts, and rules that prevent a former employee's identifier being reassigned to someone else. Auditors look for identifier allocation procedures and evidence that reuse is prevented. Identifiers for devices and workloads deserve the same discipline as those for people.\n\n**Common gaps.** Identifier reuse can give a new user access intended for a previous holder. Service account naming is often inconsistent, making ownership hard to trace. Duplicate identities across directories also complicate access reviews.","Manage system identifiers by:\n  a. Receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, service, or device identifier;\n  b. Selecting an identifier that identifies an individual, group, role, service, or device;\n  c. Assigning the identifier to the intended individual, group, role, service, or device; and\n  d. Preventing reuse of identifiers for [Assignment: organization-defined time period].\nDiscussion: Common device identifiers include Media Access Control (MAC) addresses, Internet Protocol (IP) addresses, or device-unique token identifiers. The management of individual identifiers is not applicable to shared system accounts. Typically, individual identifiers are the usernames of the system accounts assigned to those individuals. In such instances, the account management activities of [AC-2](#ac-2) use account names provided by [IA-4](#ia-4) . Identifier management also addresses individual identifiers not necessarily associated with system accounts. Preventing the reuse of identifiers implies preventing the assignment of previously used individual, group, role, service, or device identifiers to different individuals, groups, roles, services, or devices.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"compromised-azure-service-principals-enable-destructive-resource-deletion","Compromised Azure Service Principals Enable Destructive Resource Deletion","2026-09-28T20:22:52.735+00:00",{"slug":25,"title":26,"published_at":27},"ghost-service-accounts-expose-m365-environments-to-data-theft","Ghost Service Accounts Expose M365 Environments to Data Theft","2026-09-24T19:20:31.202+00:00",{"slug":29,"title":30,"published_at":31},"identity-blind-spots-why-full-visibility-is-the-cornerstone-of-identity-security","Identity Blind Spots: Why Full Visibility Is the Cornerstone of Identity Security","2026-09-19T18:20:52.227+00:00",{"slug":33,"title":34,"published_at":35},"okta-acquires-permiso-to-tackle-identity-threat-detection-gaps","Okta Acquires Permiso to Tackle Identity Threat Detection Gaps","2026-07-30T22:20:52.385+00:00",{"slug":37,"title":38,"published_at":39},"ghost-credentials-dormant-non-human-identities-create-hidden-cloud-attack-paths","Ghost Credentials: Dormant Non-Human Identities Create Hidden Cloud Attack Paths","2026-07-29T00:21:05.946+00:00",{"slug":41,"title":42,"published_at":43},"confused-deputy-flaws-enable-privilege-escalation-in-google-cloud-and-azure","Confused Deputy Flaws Enable Privilege Escalation in Google Cloud and Azure","2026-07-27T22:20:56.996+00:00",{"slug":45,"title":46,"published_at":47},"azure-automation-default-setting-enabled-cross-tenant-identity-takeover","Azure Automation Default Setting Enabled Cross-Tenant Identity Takeover","2026-07-24T16:22:30.641+00:00",{"slug":49,"title":50,"published_at":51},"synthetic-identity-fraud-pivots-to-machine-identities-and-service-accounts","Synthetic Identity Fraud Pivots to Machine Identities and Service Accounts","2026-07-23T14:21:08.376+00:00",{"slug":53,"title":54,"published_at":55},"stalkers-exploit-chrome-sync-to-silently-monitor-victims","Stalkers Exploit Chrome Sync to Silently Monitor Victims","2026-07-15T22:20:57.592+00:00",{"slug":57,"title":58,"published_at":59},"vishing-attack-tricks-odido-into-granting-access-exposing-62m-customers","Vishing Attack Tricks Odido Into Granting Access, Exposing 6.2M Customers","2026-07-10T18:20:59.526+00:00",{"slug":61,"title":62,"published_at":63},"ai-agent-identities-create-new-security-blind-spots-in-the-enterprise","AI Agent Identities Create New Security Blind Spots in the Enterprise","2026-06-16T17:20:22.059+00:00",{"slug":65,"title":66,"published_at":67},"ai-support-system-exploited-to-bypass-account-security-controls","AI Support System Exploited to Bypass Account Security Controls","2026-06-02T16:08:15.867+00:00",[69,74,79,84,88,92],{"slug":70,"name":71,"problem":72,"stories":73},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",11,{"slug":75,"name":76,"problem":77,"stories":78},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",8,{"slug":80,"name":81,"problem":82,"stories":83},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",4,{"slug":85,"name":86,"problem":87,"stories":83},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":89,"name":90,"problem":91,"stories":83},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":93,"name":94,"problem":95,"stories":96},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",3,[98,104,109,113,118,123,128,133],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","6","Control 6","Access Control Management",16,{"family":5,"item":105,"code":106,"title":107,"together":108},"ac-2","AC-2","Account Management",15,{"family":99,"item":110,"code":111,"title":107,"together":112},"5","Control 5",13,{"family":114,"item":115,"code":116,"title":117,"together":112},"gdpr","32","Article 32","Security of processing",{"family":5,"item":119,"code":120,"title":121,"together":122},"ac-6","AC-6","Least Privilege",7,{"family":124,"item":125,"code":126,"title":127,"together":122},"nist-csf","pr-ac","PR.AC-1","Identity Management, Authentication and Access Control (CSF 1.1)",{"family":99,"item":129,"code":130,"title":131,"together":132},"8","Control 8","Audit Log Management",6,{"family":5,"item":134,"code":135,"title":136,"together":137},"au-6","AU-6","Audit Record Review, Analysis, and Reporting",5]