SPA Objectives - Password Manager - Revision history

Uncouth: /* Assessment Objectives to Assess */

2025-09-10T14:47:01Z

Assessment Objectives to Assess

← Older revision		Revision as of 14:47, 10 September 2025
Line 11:		Line 11:
	PS.L2-3.9.2 – PERSONNEL ACTIONS [a,b]		PS.L2-3.9.2 – PERSONNEL ACTIONS [a,b]

	* ~~Likely will~~ be a component of the evidence for [a] and [b] but will not be the only evidence for these AOs.		* Ensuring that access to passwords that grant access to sensitive information are protected during and after personnel actions is likely to be a component of the evidence for [a] and [b] but will not be the only evidence for these AOs.

	SC.L2-3.13.10 - KEY MANAGEMENT [b]		SC.L2-3.13.10 - KEY MANAGEMENT [b]
Line 17:		Line 17:
	* May be used to manage cryptographic keys if password manager provides said functionality.		* May be used to manage cryptographic keys if password manager provides said functionality.

	== Assessment Objectives that ~~Don~~'t ~~need to~~ be Assessed ==		== Assessment Objectives that won't likely be Assessed ==
	IA.L2-3.5.7 – PASSWORD COMPLEXITY [c, d]		IA.L2-3.5.7 – PASSWORD COMPLEXITY [c, d]

	* Password complexity is typically enforced on the system containing CUI.		* Password complexity is typically enforced on the system containing CUI or its identity provider, not the password manager.

	IA.L2-3.5.8 – PASSWORD REUSE [b]		IA.L2-3.5.8 – PASSWORD REUSE [b]

	* Password reuse is typically enforced on the system containing CUI.		* Password reuse is typically enforced on the system containing CUI or its identity provider, not the password manager.

	IA.L2-3.5.9 – TEMPORARY PASSWORDS [a]		IA.L2-3.5.9 – TEMPORARY PASSWORDS [a]

	* ~~Password manager wouldn't enforce temporary password changes~~ on ~~systems containing CUI,~~ the system containing CUI ~~would do~~ the ~~enforcement~~.		* Temporary passwords are typically enforced on the system containing CUI or its identity provider, not the password manager.

Liatris: Flushed out AOs for Password Managers

2025-09-09T20:41:44Z

Flushed out AOs for Password Managers

@@ Line 5: / Line 5: @@
 == Assessment Objectives to Assess ==
-IA.L2-3.5.10 - CRYPTOGRAPHICALLY-PROTECTED PASSWORDS
+IA.L2-3.5.10 - CRYPTOGRAPHICALLY-PROTECTED PASSWORDS [a, b]
-SC.L2-3.13.10 - KEY MANAGEMENT
+* Password manager will need to securely store the passwords [a] and securely transmit them [b].

Liatris: Created page in draft form

2025-09-09T19:51:49Z

Created page in draft form

New page

== When is a Password Manager an SPA? ==
When a password manager is organizationally managed or provisioned for use within the scope of the CUI information system then the password manager should be scoped as an SPA.

When users choose to use a password manager (such as one built-in to their browser on their in-scope computers), then these are not considered an SPA, since the protection of the password is the responsibility of the user, not the organization.

== Assessment Objectives to Assess ==
IA.L2-3.5.10 - CRYPTOGRAPHICALLY-PROTECTED PASSWORDS

SC.L2-3.13.10 - KEY MANAGEMENT