NIST 800-53 r5 · Controls catalogue · Family IA
IA-3Device Identification and Authentication
Uniquely identify and authenticate {{ insert: param, ia-03_odp.01 }} before establishing a {{ insert: param, ia-03_odp.02 }} connection.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 2 mapping(s) from 1 framework(s): CSF 2.0 2 (mostly)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (8)
- T1530 Data from Cloud Storage Collection
- T1537 Transfer Data to Cloud Account Exfiltration
- T1552 Unsecured Credentials Credential Access
- T1552.005 Cloud Instance Metadata API Credential Access
- T1602 Data from Configuration Repository Collection
- T1602.001 SNMP (MIB Dump) Collection
- T1602.002 Network Device Configuration Dump Collection
- T1621 Multi-Factor Authentication Request Generation Credential Access
Weaknesses this control addresses (5)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-287 | Improper Authentication | 4,908 | Enforces unique device identification and authentication before any connection is established, directly mitigating improper authentication weaknesses. |
CWE-306 | Missing Authentication for Critical Function | 2,820 | Requires authentication of devices prior to connection, preventing exploitation of missing authentication for critical network functions. |
CWE-290 | Authentication Bypass by Spoofing | 698 | Unique device authentication makes successful spoofing of device identity substantially more difficult to achieve. |
CWE-300 | Channel Accessible by Non-Endpoint | 54 | Ensures only authenticated endpoints can access the communication channel, blocking unauthorized non-endpoint access. |
CWE-291 | Reliance on IP Address for Authentication | 10 | Mandates proper device-level authentication instead of weaker identifiers such as IP addresses that are easily forged. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-29796 | 7.0 | 9.4 | 0.0047 | good |
CVE-2026-26288 | 7.0 | 9.4 | 0.0064 | good |
CVE-2026-22552 | 7.0 | 9.4 | 0.0089 | good |
CVE-2026-26051 | 7.0 | 9.4 | 0.0087 | good |
CVE-2026-27772 | 7.0 | 9.4 | 0.0053 | good |
CVE-2026-25851 | 7.0 | 9.4 | 0.0064 | good |
CVE-2026-20781 | 7.0 | 9.4 | 0.0052 | good |
CVE-2026-27028 | 7.0 | 9.4 | 0.0052 | good |
CVE-2026-27767 | 7.0 | 9.4 | 0.0051 | good |
CVE-2026-24731 | 7.0 | 9.4 | 0.0056 | good |
CVE-2026-4370 | 7.0 | 10.0 | 0.0038 | good |
CVE-2025-27671 | 7.0 | 9.8 | 0.0057 | good |
CVE-2025-67791 | 7.0 | 9.8 | 0.0033 | good |
CVE-2025-30114 | 7.0 | 9.1 | 0.0042 | good |
CVE-2026-28536 | 7.0 | 9.6 | 0.0018 | good |
CVE-2026-23518 | 7.0 | 9.8 | 0.0023 | good |
CVE-2023-28347 | 7.0 | 9.6 | 0.0277 | good |
CVE-2026-32042 | 5.5 | 8.8 | 0.0044 | good |
CVE-2025-13914 | 5.5 | 8.7 | 0.0028 | good |
CVE-2026-38651 | 5.5 | 8.2 | 0.0030 | good |
CVE-2026-32014 | 5.5 | 8.0 | 0.0019 | good |
CVE-2025-30142 | 5.5 | 8.1 | 0.0027 | good |
CVE-2026-33724 | 5.5 | 7.4 | 0.0029 | good |
CVE-2026-41342 | 5.5 | 7.3 | 0.0013 | good |
CVE-2026-32057 | 5.5 | 7.1 | 0.0034 | good |